Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.

Published May 4, 2024 · Updated Dec 4, 2024 · Assigned by mitre