Bugs, Bounties, and Beyond...
We reply immediately
https://portal.stir.ac.uk/security/forgotten-login.jsp?error=<svg/onload=alert('XSS')>