Cross-site scripting (XSS) is another long-standing example. It allows attackers to inject malicious scripts into web applications, enabling data theft, session hijacking, and unauthorized actions on behalf of legitimate users. The technique has persisted since the late 1990s and continues to appear in modern applications, including those built on frameworks that claim to mitigate it by default. If the industry has spent so much time addressing decades-old attacks, why do they still succeed?