Design/Logic Flaw

HRworks 3.36.9 allows XSS via the purpose of a travel-expense report...