Cms exists in xss vulnerability

[China-Eugene]

When an intruder enters the backstage of a website, xss playlod can be added to the website ad management, which will trigger an attack when the user visits the website.
Vulnerability url:
http://127.0.0.1/mipcms/?s=/admin/addons/ad/AdminAd/adList

Vulnerability POC:

<script>alert(/xss/)</script>