[MEDIUM] VaahCMS is vulnerable to XSS through its Avatar Upload endpoint

PKSA-1567-r2np-36n6 CVE-2025-61183 GHSA-q769-phqg-263r

Affected package: webreinvent/vaahcms

Affected version: <=2.3.1

Reported by:
GitHub