CVE-2017-12139: Improper Neutralization of Input During Web Page Generation

XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php...