Comparison
Cross-site scriptingvsStored XSS
Cross-site scripting
someone put a script tag in their display name and it ran in everyone else's browser.
Getting attacker-controlled script to execute in another user's page, with full access to their session, their DOM and anything the origin can reach. It is the defining browser vulnerability because the same-origin policy grants that script everything your own code has. Every variant comes from the same root cause: data crossing into a context where it is interpreted as code.
Full entry →Stored XSS
the payload was saved in the database and fired for every visitor who opened the page afterwards.
The variant where the injected content is persisted server-side and served to everyone who views it. It is the most damaging kind because it needs no interaction from the victim and reaches every user of the affected view. It also outlives the fix: patching the escaping does not remove what is already stored.
Full entry →