Is it possible to make XSS attacks through html comments with JSP code inside?
- by Dmitriy Matveev
Hello!
Is it true that following code adds a XSS vulnerability to some JPS page?
<!-- <%=paramName%>=<%=request.getParameter(paramName)%><BR> -->
It looks like a "leftover debug" and definitely should be removed from the code, but how dangerous is it?