Cross-site scripting (XSS) vulnerabilities. This is the second year running they’ve topped our list as they continue to be a major threat to web applications and account for 18% of all reported vulnerabilities. Attackers exploit XSS attacks and gain control of a user’s account to steal personal information such as passwords, bank account numbers, credit card details and more. Our customers awarded over US$4.2 million in total bounty awards, up 26% on 2019.
Common vulnerabilities such as XSS are often dismissed by CISOs fond of chasing "threat du jour", but hackers consistently show us that these neglected best practices continue to be one of the most effective ways to compromise personal data.