UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action.
ucms project ucms 1.4.7