engineercms cross-site scripting vulnerability

engineercms is an open source engineer knowledge management system . Specifically for civil engineers to create a suitable web-based knowledge management system . It can be used to manage both individual project information , but also for managing project team information ; it can run on both personal computers , but also put on the server . engineercms cross-site scripting vulnerability , the vulnerability stems from engineercms version 1.03 vulnerable to cross-site scripting attacks in the nickname field of the user list page without escaping . An attacker could use the vulnerability to execute JavaScript code in the user’s browser when viewing the page.