Joshuap

The issue concerns a stored XSS vulnerability in the Filemanager component. This can be exploited via a .pxd file, as shown by sending `m1 files[]` to the "admin/moduleinterface.php" endpoint.

The issue allows remote code execution via a specially crafted .php.jpegd JPEG file. This can be achieved by sending a file as application/octet-stream to the `admin/moduleinterface.php` endpoint, specifically using the `m1 files[]` parameter. The file does not need to be a valid JPEG, but it should contain PHP code.