Hacksplaining Log in

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

This means an attacker can construct a URL with malicious JavaScript in the URI fragment...

Dangerous use of innerHTML
JavaScript 
window.addEventListener('load', () => {
  const page = window.location.hash.slice(1);
  loadPage(page);

  document.getElementById('page-no').innerHTML = page;
});
www.chinterest.com#<script>window.location="www.haxxed.com"</script#>
Mal the hacker