Code injection

An issue was discovered in Eventum 3.5.0. /htdocs/popup.php has XSS via the cat parameter...