The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms.
CWE-79