xss attack vulnerabilty in breadcrumbs