The cookie parameter in profile.php has an XSS vulnerability.

[gtqbhksl]

On the profile.php page, line 20 will output, echo$_ SESSION ['username '].' - Профиль';， But$_ SESSION ['username '] is obtained through the if (isset ($-COOKIE ['username cookie')) {$_SESSION ['username ']=$-COOKIE ['username cookie'];} in the cfg. php file，$_ COOKIE ['username cookie '] is something that users can manipulate and can cause XSS vulnerabilities.

[AlexanderLivanov]

in progress, thanks 🤝

[jzySaber1996]

CWE-ID: CWE-79
Assigned CVE-2023-5837

[AlexanderLivanov]

I will cut this bug in new version. Thanks for your support

[AlexanderLivanov]

Hello everybody, I have just fixed this bug in new version. Thanks for your support