distant attackers can inject JavaScript code without authorization. Exploiting this vulnerability, attackers can steal consumer credentials or execute actions such as injecting destructive scripts or redirecting people to malicious sites. Should the question string contains sensitive data which include session identifiers, then attackers can use t