stored XSS in "http://<APP-IP>/people/<ID>/avatar"

[D4rk$1d3]

Is possible to perform a stored XSS uploading a malicious image

Let me know if you need more information about this bug and how to reproduced it

[Alexis Saettler]

Please send any detail to [e-mail]