299Ko's public contact form improperly handles user input by inserting raw POST field values into the page template without sanitization. This results in a reflected cross-site scripting (XSS) vulnerability where an unauthenticated attacker can inject malicious scripts that execute in the context of users who submit or auto-submit the form, potentially including administrators. The vulnerability arises because the template engine outputs variables without escaping HTML special characters.