Cross-site scripting
Someone else's script on your pages.
The most common kind of flaw found in website plugins. A stranger gets your site to show their script to your visitors, and the browser runs it as if you had written it.
Plate VI. Kinds of flaw
What a flawcould let happen.
Every known flaw in your report is one of a few kinds. Here is what each kind could let someone do to a website, why it happens, and how it gets fixed.
Database injection
The question gets changed.
Your site keeps its customers, orders and passwords in a database, and asks it questions all day. This flaw lets a stranger change the question.
Running code
A stranger's program, on your server.
The most serious kind of flaw. A stranger gets your server to run their own program, and from then on they can do whatever your site can.
Reading files
Out of its folder, into your settings.
Your server holds more than your web pages. This flaw lets a stranger ask for files that were never meant to be shown, such as the settings file with your database password.
Knocking it over
One heavy request, everyone waits.
Not every flaw is about getting in. Some let a stranger tie your site up with a few requests the software was never built for, so real visitors cannot get through.
Forged requests
Sent through your browser.
While you are signed in to your site, your browser carries your login everywhere. This flaw lets another site use that to make changes in your name.
Missing checks
The side door nobody locked.
Your login page checks who you are. This flaw is a part of the software that forgets to, so someone can do an administrator's job without being one.