Often attackers will inject JavaScript, VBScript, ActiveX, HTML, or Flash to fool a user (Read below for further details), or gather data from them. Everything from account hijacking, changing of user settings, cookie theft/poisoning, or false advertising is possible. New malicious uses are being found every day for XSS attacks. The post below by Brett Moore brings up a good point with regard to "Denial of Service", and potential "auto-attacking" of hosts if a user simply reads a post on a message board.
News: Server Security
