security-vulnerability public under software-bug 7 List Picture As a command cross-site-scriptingsql-injection