This is an attack that takes advantage of a web site vulnerability in which the site displays content that includes un-sanitized user-provided data. What is this attack?

XSS occurs when a web application includes unvalidated, un-sanitized user-supplied data in its HTML output, allowing attackers to inject client-side scripts that execute in other users' browsers. The attack leverages the browser's trust in content served from the legitimate site, enabling session hijacking, credential theft, or malicious redirects. The key indicator in this question is 'un-sanitized user-provided data displayed by the site,' which is the precise definition of reflected XSS.

SQL Injection targets back-end database queries by injecting malicious SQL syntax, not client-side script execution through unsanitized web page content.

URL traversal (path traversal) attacks manipulate file paths in URLs to access unauthorized server-side files, which is unrelated to injecting scripts into displayed content.

Buffer overflow attacks exploit memory management flaws in compiled applications to overwrite memory, which is unrelated to web content rendering or user-supplied HTML output.