Insufficient filtering of incoming data, which can lead to a potential threat of an XSS attack.

Version error: 12.1 and below

Degree of danger: High

To fix the problem, open the file engine/classes/parse.class.php and find in it:
    function clear_url($url) {
        global $config;

add below:
    $url = str_replace(array("{", "}", "[", "]"),array("%7B", "%7D", "%5B", "%5D"), $url);

This patch is intended for version 12.1 and all versions below version 12.1