title: Is this a security vulerability, XSS or CSRF?
body: <p>Lets say my javascript makes an ajax-request and in the callback-function it does eval(response_text) without checking the response_text for anything. </p>
  
  <p>Something tells me this is not good, but why and how could it be epxloited? Wont it be always my server which will send it good data?</p>