HTML Injection in Contact Form Email Enables Phishing via Legitimate ████████ Infrastructure

The contact form email endpoint at `POST ████████/contacts/email` on `████████` accepts a `firstName` field that is rendered as raw, unescaped HTML in the body of the transactional confirmation email sent via SendGrid. The email greeting reads "Buongiorno {firstName}" where `{firstName}` is …

Buongiorno {firstName} {lastName},