Doesn't strip script tags or anything; lots of nasty stuff you could do with this. Somebody should notify them.

https://www.maybank2u.com.my/mbb/m2u/jsp/common/mbbReceipt.j...