Type 1 missing the point Due to the general requirement of the use of some social engineering in this case and normally in Type 0 vulnerabilities as well many programmers have disregarded these holes as not terribly important This misconception is sometimes applied to XSS holes in general even though this is only one type of XSS and there is often disagreement in the security community as to the importance of cross site scripting vulnerabilities This section misses the entire point If I wanted to grab cookies from users using some form of local JavaScript exploit just an example there are hundreds of other things possible I could use a type 1 vulnerability on a forum or popular website in order to attack the maximum number of users The social engineering side of it is therefore a side note as it only applies when an attacker is targeting one specific user and even then if they know they frequent that site they don t have to social engineer them at all Furthermore what s with the names in the exploit scenarios I m all for equality but I d like to see names in there that are at least somewhat universally pronounceable and single barrelled Try something like Anne instead of Lorenzo de Medici 86 14 89 251