https://blog.tegalsec.org/bug-bounty-xss-file-upload-vulnerability/