C-sharp : XSS due to insufficient validation

The application uses encoding that is insufficient for preventing the execution of malicious code in the client browser.

The use of certain types of encoding (HTML, XML) prevents only some XSS attack. Typically, the encoding replaces the characters “<”, “>”, “&”, “ ‘ “. But depending on the context other characters also can acquire a special meaning. An attacker can exploit this to execute malicious code in the browser (cross-site scripting or XSS).

In addition to the JavaScript language, HTML, Flash, and other appropriate languages are used to write malicious code designed to run in the browser. XSS attacks may pursue different goals, in particular, to transfer victim’s session data (cookies, session ID, and so on) to the third-party server and to redirect the victim to a malicious site.

The same applies to mobile applications, if JavaScript is not disabled in WebView.