xss bug report