Cross site scripting - Reflected

The application does not filter text or other data for potentially malicious HTML content. This enables an attacker to craft arbitrary HTML content. Cross site scripting occurs when dynamically generated web pages/web services reflect user input as it is, that is not properly validated, allowing an attacker to steal session, force browsing etc.

Impact: Cross site scripting could result into site defacing, session hijacking and data theft etc. Usually, an attacker will attempt to manipulate an XSS vulnerability in order to present malicious HTML as if it came from a legitimate source. This attack is often combined with a social engineering attack that attempts to trick users into divulging their passwords, financial, or personal information.