Summary by pphreak_1001
The domain, https://gigs.indeed.com/ had an email html injection vulnerability on gigsearch. The GET parameter l= was the vulnerable parameter here, When html was injected in it, nothing would be triggered on the webpage but when the gigsearch alert form was filled for Job alert with victim's email, the payload was triggered in received email.
