Tdevs

**Name of the Vulnerable Software and Affected Versions** tdevs Hyip Rio version 2.1 **Description** A problematic issue has been found in the Profile Settings component, specifically in the /user/settings file, where the manipulation of the `avatar` argument leads to cross-site scripting. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond. **Recommendations** For version 2.1, as a temporary workaround, consider restricting access to the `avatar` argument in the Profile Settings component until a patch is available. Additionally, restrict access to the /user/settings file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.