xss can be triggered when the application?
XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. ... The end user's browser has no way to know that the script should not be trusted, and will execute the script.