Description

Html injection in Contributors and just only need html payload in Display Name and fire in Contributors list

Proof of Concept

1. Login to squidex 
2. Create an app with random name.
2. Go to Edit Profile then Edit users display name with html payload = <h1>Sanket_722</h1>
3. Go to https://localhost/app/{App/Random Name}/settings/contributors 
For Full understanding check POC : https://drive.google.com/file/d/1W8KdHgQKBRvRDKbNnPvrv9fYWItI9gQa/view?usp=sharing
// PoC.js
var payload = <h1>Sanket_722</h1>

Impact

inert html character in Contributors list and change response with special character