html injection vulnerabilities and exploits