An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list \attached\ attribute (which typically has 'class=\icon-globe icon-large\' in its value) as demonstrated by an 'UPDATE sys_module SET attached = \XSS\ WHERE id=\page_list\' statement.