Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim