DOM-based cross-site scripting (XSS) happens when the web application writes user input to the Document Object Model (DOM), then reads the data from the DOM and executes it in the browser. It often happens that the malicious code is not sent to the server, which makes it difficult to detect by web application firewalls (WAFs) and security engineers who analyze server logs.
Learn more about DOM-based cross-site scripting.