In fact, cross-site scripting may be the most common unpatched bug in the world.

FORBES: Magazine Article

Many of those gadgets, Sutton has discovered, are vulnerable to "cross-site scripting, " a technique that could allow a hacker to impersonate a legitimate user.

FORBES: Magazine Article

The security world has long seen the Web as a buggy, infected tangle of sites vulnerable to hacks like cross-site scripting and SQL injection.

FORBES: Researchers Say Hijackable Bug Infects 30% Of Websites

The hack is a simple cross-site scripting vulnerability, a flaw in how Skype handles user input and prevents it from being interpreted as commands on the target machine.

FORBES: Researcher Claims Simple Skype Bug Lets Hackers Hijack Contacts' Accounts

For cross-site scripting, which allows an attacker to inject his or her own code into a website, 75% of government-written applications were vulnerable, compared with 67% in the finance industry and 55% of commercial software.

FORBES: Study Confirms The Government Produces The Buggiest Software

The tool takes advantage of cross-site scripting, a common bug in Web sites that takes control of a user's browser when he or she clicks on a specially crafted link, or in some cases, simply visits a compromised page.

FORBES: Magazine Article

But cross-site scripting, a bug that allows a user to be tricked into clicking on a maliciously-crafted URL that causes a site to run a potentially dangerous script in their browser, still affects more than half of sites it tested.

FORBES: Researchers Say The Web May Be Offering Fewer Footholds To Hackers

Google hacking was first popularized by Johnny Long, a penetration tester who created a Google Hacking Database that allowed anyone to add interesting security search queries that might turn up vulnerabilities to exploits like SQL Injection or Cross-Site Scripting.

FORBES: Researchers Will Turn Google And Bing Into Web Bug Warning System