Cross-site Scripting (XSS) - Reflected (CWE-79)CVSS 7.2€600
Escalating a Reflected XSS to High Severity via Filter Bypass and Cache-Assisted Delivery
Generic XSS caused by improper handling of user-controlled input in the URL path
Vulnerability Summary
A reflected XSS vulnerability was identified in a public-facing web application, where attacker-controlled input from the URL path was reflected unsafely into HTML metadata within the <head> section.
By crafting a payload that bypassed input filtering and leveraging cacheable responses, this vulnerability evolved from a simple reflected XSS into a higher-impact issue affecting future visitors requesting the same poisoned resource.