Which of the following threat types involves the sending of untrusted data to a user's browser to be executed with their own credentials and access?

The correct answer is B. Cross-site scripting. Cross-site scripting (XSS) is an attack where a malicious actor is able to send untrusted data to a user's browser without going through any validation or sanitization processes, or where the code is not properly escaped from processing by the browser. The code is then executed o

Submitted by ravi_2018· Apr 18, 2026Cloud Application Security

Question

Options

AMissing function level access control
BCross-site scripting
CCross-site request forgery
DInjection

How the community answered

(37 responses)

A
5% (2)
B
89% (33)
C
3% (1)
D
3% (1)

Explanation

Cross-site scripting (XSS) is an attack where a malicious actor is able to send untrusted data to a user's browser without going through any validation or sanitization processes, or where the code is not properly escaped from processing by the browser. The code is then executed on the user's browser with the user's own access and permissions, allowing an attacker to redirect their web traffic, steal data from their session, or potentially access information on the user's own computer that their browser has the ability to access.

Topics

#Cross-site scripting (XSS)#Web application vulnerabilities#Client-side attacks#Application security

Community Discussion

No community discussion yet for this question.

Full CCSP Practice