Stored XSS into HTML context with nothing encoded
https://portswigger.net/web-security/cross-site-scripting/stored/lab-html-context-nothing-encoded

Let's comment the following payload below the post:
<script>alert("1");</script>
Since this payload is stored on the page in the form of a comment it will be executed for every user that visits the page.

We have solved the lab.

Last updated
Was this helpful?