[QUOTE="chekist"]
xss, проверял на 8.5 и 8.2
file /engine/modules/imagepreview.php
[PHP]
[COLOR="#000000"]
$_GET['image'] = @htmlspecialchars($_GET['image'],ENT_QUOTES);

if(preg_match([COLOR="#DD0000"]"/[?&;%