I am getting a XSS vulnerability through burp suite but when I inject script manually I don't get the XSS vulnerability.
Is this a reportable vulnerability?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If you can't verify the result of an automated tool, it is not a good idea to report it's findings.
Automated tools are great, but they have a problem with false positives.
Is this reflected XSS? One of the common reasons this can be difficult to reproduce is because of browser XSS filters. I recommend you use Firefox which does not have a filter.
To properly determine if this is exploitable you need to gain an understanding of what is happening - what characters get through the filter, what page context the reflection is in, etc.
If you'd like the Portswigger support team to look at this, please send screenshots of the advisory, request and response to firstname.lastname@example.org