language; for XSS, it's at a level above the programming language.
There are several potential applications, only two of which are covered here.
1) Gap analysis and finding new vulnerability classes
By moving up a level of abstraction from classes like buffer overflows, XSS, and privilege