No real impact statement — ‘attacker can execute JS’ is not enough - Asecurity Academy No real impact statement — ‘attacker can execute JS’ is not enough - Asecurity Academy