@Hydrooj/Ui-Default (< 4.59.1)

Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script through profile bio fields.