PCI scan in our servers recently failed due to cross-site scripting vulnerability in Magento 2 pages. They have requested like below to reproduce the issue.
REQUEST: GET /2018-2019-random-url.html?<script>alert('TK00000031')</script> HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Host: example.com Content-Type: text/html Content-Length: 0 Evidence: <script>alert('TK00000031')</script>
But we couldn't reproduce it in any browsers. Only in IE it detects it's cross-site scripting and stops the execution of the page.
Does anyone faced the same issue and got the resolution?