Due to inadequate input cleansing prior to using data received from the client. In this case, the penetration testing tools identifier is reflected in the response as it is received from the client, allowing an attack vector for an XSS attack.