Reflected XSS: Creating a Question

[dkatzz]

Describe the bug

• Insufficient input sanitization in the 'Question Name' and 'Description' fields creates a reflected XSS vulnerability. This could allow admin users to inject malicious scripts like <IFRAME SRC="javascript:alert('XSS');"></IFRAME> or xxs link, compromising the application's security.
• Insufficient input sanitization in the 'Question Name' and 'Description' fields creates a reflected XSS vulnerability. When applicants view the application form, malicious payloads like <IMG SRC="javascript:alert('XSS');"> or <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> within these fields can execute, leading to an unexpected error.

Recommendations Sanitize and validate the input from all fields that an applicant or an admin can use

[nb1701]

Is this only an admin-side problem, or is any user input as an answer to a question vulnerable to the same thing?