HTML injection vulnerability poc | bug bounty poc