Information disclosure

FlyCms through abbaa5a allows XSS via the permission management feature...