Opencart is vulnerable to cross-site scripting (XSS). The attack is possible because it does not sanitize the filename argument in the image upload section of admin panel, allowing an attacker to inject malicious script and get the script executed when a user visits the Image manager section.
packetstormsecurity.com/files/157908/OpenCart-3.0.3.2-Cross-Site-Scripting.html
github.com/opencart/opencart/blob/4ba536198a4638b6d3902a7c720ce8503b0dc394/upload/admin/controller/common/filemanager.php#L80-L82
github.com/opencart/opencart/blob/4ba536198a4638b6d3902a7c720ce8503b0dc394/upload/admin/controller/common/filemanager.php#L87-L91
github.com/opencart/opencart/issues/7810