Input validation is a frequently-used technique for checking potentially dangerous inputs in order to ensure that the inputs are safe for processing within the code, or when communicating with other components. When software does not validate input properly, an attacker is able to craft the input in a form that is not expected by the rest of the application. This will lead to parts of the system receiving unintended input, which may result in altered control flow, arbitrary control of a resource, or arbitrary code execution. We acknowledge that scrips are not being executed however from the below screenshot it appers that the input special characters or tags are not encoded. If possible implement input validation to allow only required characters payload such as <script>alert(123)</script> is stored and subsequently displayed as text suggests that the application may still be accepting arbitrary input that falls outside the expected data format. It is recommended to implement allow-list input validation strategy throughout the application, allowing only the required characters.
... View more