Steps to reproduce

• After login into demo account, Go to the transaction page and there your can add or create an expense
• If your on the write path, while creating or adding an expense there will be description field
• In the Description field, enter the following payload <marquee onclick=\u0041\u006cert("_Y000!_")>Y00</marquee> and click save
• Now, you can have a look at the proof of concept below where our HTML code got executed and its running

Proof of concept

Impact

It can allow an attacker to modify the page. To steal another person's identity. The attacker discovers injection vulnerability and decides to use an HTML injection attack. Attacker crafts malicious links, including his injected HTML content, and sends it to a user via email