Cross site scripting on contact module

Step to reproduce

1. Open into https://demo.corebos.com and navigate to settings > Users.
2. Add XSS payload into Entity Name.
3. Now navigate to contact > Create contact > Add contact and click on more information > click add opportunity.
4. On Assign to drop menu select XSS payload and save.

XSS Payload= "&gt;<img src>