Hey - Nice Site. I noticed the below vuln because you currently aren't filtering inputs sufficiently. The validation looked weak as it was rendering html, so I

Hey - Nice Site. I noticed the below vuln because you currently aren't filtering inputs sufficiently. The validation looked weak as it was rendering html, so I did a bit of testing and found you can run javascript hidden in an image tag like the below: <IMG """><SCRIPT>alert("XSS")</SCRIPT>"\> You can see this running on the below: https://www.careerfair.io/reviews/test https://www.careerfair.io/reviews/test I suspect if I put this in the job name it might actually run the javascript when anyone visits the homepage?