Currently D365 CRM allows us to enter any characters in single and multi line text fields. We can for instance enter a script in such field. It has not executed the script; however, the output to the user is in a script form. Which can then be sent to a secondary application and can potentially cause XXS Vulnerability.

Ability for Sanitization and Escaping Functions could help eliminating acceptance of scripts in fields.
Example of text entered in a single line text field "Name" on Account Entity: