Stored XSS in an iPhone (the database address and other information have been returned)

Stored XSS in an iPhone (the database address and other information have been returned)

0x01
Someone recommended me a software called one password that day:


 


 
This can be synchronized to the cloud, and password transmission can be performed on different terminals.
But what does it have to do with today's vulnerabilities?
The cloud used by this software is different from others' cloud. It uses iCloud:


 
Start test:
It has remarks and login information that can be saved or synchronized to the cloud:


 
We insert code in the remarks and login information locations (other locations are also required:



 


 
Then synchronize to iCloud:


 
Then return the cookie:


 
The two locations are different, indicating that the two locations are inserted at different locations.
0x02
(1) first, why is the iPhone xss, not ios, because it uses third-party software rather than the system itself.
(2) Is this stored xss or self xss? What the team thinks is self-plug... You know ..