Advisories for Composer/Sulu/Form-Bundle package

TokenController get parameter formName not sanitized in returned input field leads to XSS. What kind of vulnerability is it? Who is impacted?