Deriv.com: HTML injection via 'underlying' parameter

roshanpty Discovered an HTML injection. But unfortunately this was already discovered by another researcher who even managed to bypass and execute a script...