[SIM-5186353]

I found that the website is vulnerable to XSS, the first time I did a test to see if it was vulnerable to xss it gave me a 200 response and showed to be vulnerable, but when I tested it again by sending this payload <img src="http://ip:port/?vulnerable=true"> (I had a nc listener running)
It shows me the 302 error, but when I run the scan again it shows me that it is vulnerable so I don't know what is failing. Even i redirect it keeps failing.
Any help??

[w0rd]

Did you check:
Content Security Policies?
X-Content-Type-Options?
X-XSS-Protection?
Referrer-Policy?
Strict-Transport-Security (HSTS)?

What about cookie attributes (for session hijacking)?
Secure?
SameSite?
HttpOnly?