CVE-2018-13865: Improper Neutralization of Input During Web Page Generation

An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...