Self xss and html injection bug bounty poc 2024