This is a stored cross-site scripting attack. The attacker submits JavaScript into a product review form, and the application stores and displays it later to other users. When victims view the review, their browsers execute the attacker’s script as if it came from the trusted site. That is dangerous because the script can access browser-side data available to the page, such as cookies, tokens, page content, or session-related information depending on browser and cookie security settings. It does not directly leak the back-end database; that would be more aligned with SQL injection. It also does not inherently bypass login pages or require the victim to click a link. The core risk is malicious code execution in the victim’s browser.

================