CVE-2022-25574

33th percentile - higher than 33% of all known CVEs

A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file.

An attacker can inject malicious JavaScript code that will be executed in other users' browsers, potentially leading to session theft, account takeover, or data theft.

Update the software to the latest version that fixes this vulnerability and implement file upload validation and sanitization, including MIME type and content checking.