The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote malicious users to conduct cross-site scripting (XSS) attacks
ulli horlacher fex