Cross site scripting

AppCMS 2.0.101 allows XSS via the upload/callback.php params parameter...