concrete5/concrete5 — pull request #1801 by mmetince (2014-06-23 13:15:47+00:00)
Title: Encoding themeHandle variables in order to prevent XSS vulnerability.

I found that themeHandle variables used without input validation/encoding so it cause to Cross-Site Scripting Vulnerability.

PoC:

http://localhost/concrete5/index.php/tools/required/themes/preview?previewCID=1&ctID=&themeHandle=1337">