When a mobile client sends feedback, XSS

Blind play, X to the background found that all apps of the company can push messages to the background (many apps of the company, various platforms, and all the feedback are sent to the background ), if the PUSH message is used for illegal purposes, the consequences can be imagined. Therefore, the vulnerability level is high.
After the cookies are obtained blindly, open the address and identify that authentication is required. As a result, paste the whole URL into the log-on interface. (Administrator's negligence, configuration defects, and non-validation sub-Directories ). Then we changed the COOKIE and went to the background. The following APP is the meaning section of IOS
 



The following figure shows the APP pop-up information on the push message sending page.


 Solution:Input/Output HTML encoding, or filter special characters. If the token exists in the form, it seems that programmers are also aware of it. I guess: Are there such vulnerabilities in many apps of the company?