CVE-2023-0493: Withdrawn Advisory: HTML injections in BTCPayServer

The vulnerability stems from missing HTML encoding of user-controlled input in multiple controller actions and views. The GitHub commit shows systematic addition of Html.Encode() to variables like app names, email addresses, and API key labels that were previously rendered raw in confirmation dialogs and UI elements. These locations directly injected user input into HTML contexts without proper neutralization, enabling HTML injection attacks. The high confidence comes from the direct correlation between the patched locations and the vulnerability description about improper neutralization of special elements.