CVE-2020-23868

NeDi 1.9C allows inc/rt-popup.php d XSS.