Comment on Faking votes on Hacker NewsparentComments−tlrobinson17yXSS, yes. CSRF, no, or at least not completely. You still need to know the user's username, which is better than it could have been.This was a CSRF attack, which is mostly unrelated to XSS.
Comments
XSS, yes. CSRF, no, or at least not completely. You still need to know the user's username, which is better than it could have been.
This was a CSRF attack, which is mostly unrelated to XSS.