system_usermanager_addprivs.php: User account full name is not encoded before output
User Manager / Privileges
Plus Target Version:
On system_usermanager_addprivs.php, the user name and full name are displayed at the top of the page for reference. The full name is not encoded before output, leading to a potential XSS.