Stored / Persistent XSS
Stored Cross-Site Scripting arises when an application receives input from an untrusted source and includes that data within its later HTTP responses in an unsafe way.
User submitted thread comments are stored persistently in the database and rendered raw to all readers.
The application uses a naive regex to strip script tags once, which can be bypassed using nested tags.
User profile website URL is stored and rendered inside an href attribute and tooltip attribute.
A server filter strips specific lowercase keywords, but fails against case variations and alternative handlers.
Data is safely sanitized in the primary profile view, but rendered raw in an administrative audit log.
A simulated privileged compliance officer automatically reviews submitted tickets with administrative credentials.