Home Reports


- 3 min read

Reflected Cross-Site Scripting (RXSS) Report Template

img of Reflected Cross-Site Scripting (RXSS) Report Template

Reflected Cross-Site Scripting XSS


  • Target Name: [target-name]
  • Title: Reflected Cross-Site Scripting (RXSS) in [rxss-param] Parameter on [rxss-hostname][rxss-path].
  • Category: Injection
  • CWE: 79 – Improper Neutralization of Input During Web Page Generation (CWE-79)
  • CVSS: 6.1
  • Vulnerable Location: [rxss-hostname][rxss-path]
  • Vulnerable Parameter: [rxss-param]
  • Payload: [rxss-payload]
  • HTTP Request:


A reflected cross-site scripting vulnerability was found on the [rxss-hostname] domain at the [rxss-path] endpoint in the [rxss-param] parameter.

Reflected Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser-side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

Proof of Concept

Visit the below URL to see the domain [rxss-hostname] in a pop-up alert box. The domain name verifies the DOM is reachable through this cross-site scripting attack, allowing the attacker to access cookies.

  • Link to full URL with Payload: poc-payload
  • URL with payload in plain text: poc-payload


An attacker can use a reflected cross-site scripting attack to steal [rxss-hostname] cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface [rxss-hostname] or embed malicious content.


Mitigate XSS attacks by using the following best practices.

Validate and sanitize user input Make sure to validate and sanitize all user input to ensure that it does not contain any malicious code. This can be done using server-side input validation and sanitization functions.

Use content security policies (CSPs). CSPs allow you to specify which domains are allowed to load resources on your website. This can help to prevent attackers from injecting malicious code from third-party domains.

Use an XSS prevention library. There are several libraries available that can help to prevent XSS attacks by automatically escaping user input and implementing other security measures.

Keep your software and libraries up to date. Make sure to keep all software and libraries used on your website up to date to ensure that you have the latest security fixes and patches.

Find out more from OWASP’s Cross Site Scripting Prevention Cheat Sheet

Severity Scores

CWE-79: Improper Neutralization of Input During Web Page Generation.

CVSS v3.1 Base Score: 6.1


Attack VectorNetworkThe attack can only be exploited over a network. The target [rxss-hostname] can be accessed over the internet.
Attack ComplexityLowThe attacker can expect repeatable success.
Privileges RequiredNoneThe attacker requires no privileges to perform the attack.
User InteractionRequiredA victim needs to click the malicious link created by the attacker.
ScopeChangedThe vulnerable component is the vulnerable [rxss-hostname] server. The impacted component is the victim’s browser.
ConfidentialityLowInformation in the victim’s browser associated with [rxss-hostname] can be read by the malicious JavaScript code and sent to the attacker.
IntegrityLowInformation in the victim’s browser associated with [rxss-hostname] can be modified by the malicious JavaScript code.
AvailabilityNoneThe malicious JavaScript code cannot significantly impact the victim’s browser.