Reflected XSS Via origCity Parameter (UPPER Case + WAF Protection Bypass)