A "Server-Side Includes" attack refers to the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary code remotely. Which web-page file type, if it exists on the w

The `.stm` (Server-Side include Text Mark-up) file extension is a historical and common indicator for pages that are intended to be parsed by the web server for Server-Side Includes (SSI) directives. If a server is configured to process files with this extension for SSI, it signals that SSI is active, which represents a potential vulnerability if input is not properly sanitized.

The `.cms` file extension is not a standard indicator for Server-Side Includes processing; it typically relates to a Content Management System's internal file handling.

The `.rss` file extension is used for Really Simple Syndication feeds, an XML-based format for distributing web content, and is unrelated to Server-Side Includes processing.

While web servers can be configured to process `.html` files for SSI, this is not a strong or primary indicator of SSI vulnerability as most `.html` files are static, whereas extensions like `.stm` explicitly denote SSI usage.