I ran a vulnerability scan on my application using Burp suite. Some of my input fields can take HTML code (e.g.
<script>alert("exploited")</script>) and it will be displayed as text but never executed as HTML or script. To be specific it is stored as a string and is always treated as such.
Please find below screenshot:
I believe this cannot be treated as XSS vulnerability, since the script never really gets executed. Is that correct, or am I vulnerable here?