CVE-2018-11735: Improper Neutralization of Input During Web Page Generation

index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter...