CVE-2021-36605

engineercms 1.03 is affected by a Cross-Site Scripting (XSS) vulnerability in the nickname field on the user list page due to lack of escaping. When an admin or user views the page, the embedded JavaScript can be executed in the attacker’s browser, potentially compromising user sessions or creden...