1

... no user profiles on this page XSS (including reflected XSS) can basically do everything inside the site what the user with a browser can do. If there are no user profiles it can at least not impersonate any users. Note though that if there are users on the same domain or subdomain, then XSS might use existing session cookies to impersonate the logged in ...


Only top voted, non community-wiki answers of a minimum length are eligible