In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')