Design/Logic Flaw

JEECMS 9.3 has XSS via an index.do/content/update?type=update URI...