When a website contains JavaScript that takes an attacker-controllable value, known as a source, and passes it into a harmful function, known as a sink, DOM-based vulnerabilities occur.