Design/Logic Flaw

ArticleCMS through 2017-02-19 has XSS via the /updatepersonalinfomation realname or email parameter...