Home Reports


- 2 min read

Stored Cross-Site Scripting Vulnerability Report Template

img of Stored Cross-Site Scripting Vulnerability Report Template

Stored Cross-Site Scripting (XSS) Vulnerability Report

Vulnerability Overview

Stored Cross-Site Scripting (XSS) vulnerabilities occur when user-supplied input is stored on a server and later displayed to other users without proper validation or encoding, enabling an attacker to inject malicious scripts that execute in the context of victims’ browsers.

Vulnerability Details

  • Affected Component: [Specify the affected component/module/page where Stored XSS vulnerability is present]
  • Vulnerable Input Field: [Identify the specific input field or parameter vulnerable to XSS injection]
  • Attack Vector: [Describe how an attacker can exploit this vulnerability]
  • Impact: [Detail the potential impact of successful exploitation, such as session hijacking, cookie theft, or phishing attacks]

Steps to Reproduce

  1. Inject Payload: Submit a crafted script payload containing malicious code through the vulnerable input field.
  2. Store Payload: Confirm that the payload is successfully stored on the server without being sanitized or encoded.
  3. Trigger Execution: Access the page or resource where the stored payload is displayed, triggering the execution of the injected script in victims’ browsers.
  4. Observation: Observe the impact of the injected script, such as pop-up alerts, cookie theft, or redirection to malicious websites.

Proof of Concept (PoC) Code

   <!-- Example of Stored XSS Payload -->
<script>alert('Stored XSS')</script>


  • Input Sanitization: Implement strict input validation and output encoding to sanitize user-supplied input before displaying it to other users.
  • Content Security Policy (CSP): Deploy a Content Security Policy to mitigate the impact of XSS attacks by restricting the execution of scripts and other potentially harmful content.
  • Regular Security Audits: Conduct regular security audits and code reviews to identify and remediate XSS vulnerabilities in the application codebase.

Remediation Steps

  • Identify and patch the vulnerable component/module/page to prevent Stored XSS vulnerabilities.
  • Implement security controls to sanitize and validate user input before storing or displaying it to other users.
  • Educate developers about secure coding practices and the importance of input validation and output encoding to prevent XSS attacks.

Disclosure Timeline

  • [Date]: Vulnerability discovered.
  • [Date]: Initial communication with the vendor/developer.
  • [Date]: Vulnerability details shared with the vendor/developer.
  • [Date]: Vendor/developer acknowledgment of the vulnerability.
  • [Date]: Vendor/developer patch release or mitigation deployed.
  • [Date]: Public disclosure of the vulnerability.


Please replace placeholders such as [Specify], [Identify], [Describe], and [Date] with relevant information specific to the Stored XSS vulnerability being reported.