Which vulnerability allows injecting malicious scripts into web pages viewed by others?

• A. Cookie tampering
• B. Nessus role
• C. OpenVAS stands for
• D. XSS Reflection

Answer: (D)

Cross-Site Scripting is a vulnerability that lets attackers inject malicious scripts into web pages that other users will load. In the reflected form, the injected script comes from the user’s input and is immediately echoed back by the server in the response, so when the victim clicks a crafted link or submits a form, the script runs in that user’s browser in the context of the trusted site.

This type of attack is powerful because the code executes with the user's session privileges, enabling actions like stealing cookies or session tokens, redirecting to malicious sites, or performing actions on behalf of the user. The reflected variant is a common scenario where the attack payload is included in the URL or form data and reflected back in the page content.

The other options don’t describe injecting scripts into pages viewed by others. Cookie tampering involves altering cookies, not injecting scripts. The other two items are not vulnerabilities themselves but refer to a vulnerability scanner and a term for a product, so they don’t fit the concept of injecting scripts into web content.