While reviewing logs, a security administrator identifies the following code: Which of the following best describes the vulnerability being exploited?

The code document.cookie is JavaScript, and its presence in a log often indicates an attempt to steal session cookies. This is a classic example of a Cross-Site Scripting (XSS) attack. XSS vulnerabilities allow attackers to inject malicious client-side scripts into web pages viewed by other users, often to bypass access controls, impersonate users, or steal sensitive information like cookies. SQLi (SQL Injection) involves injecting malicious SQL queries into input fields to manipulate a database, which is not what this JavaScript code does. DDoS (Distributed Denial of Service) attacks aim to overwhelm a system with traffic, not execute client-side scripts. CSRF (Cross-Site Request Forgery) tricks a user into executing unwanted actions on a web application where they are authenticated, but it doesn't typically involve injecting document.cookie directly into a script for theft.