There is stored xss vulnerability

[czming123]

Bug Report

I found stored-xss vulnerability in the website everywhere. I run the project in my environment with tomcat. In article comment editing , I insert some xss payload for my test. payload: <img src=x onerror=alert(1) /> we can see the javascript payload is effective. And then I test the name input, It also has the problem.

When the admin user logins in the site in background, it also strikes in the website.

[czming123]

not just in comment, the name can also insert xss payload to attack