zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /pay.php.
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)