CVE-2022-0501: Cross-site Scripting in Beanstalk console

The vulnerability stems from the handling of the 'server' GET parameter in the global scope of lib/include.php without proper sanitization. The code directly assigns $_GET['server'] to $GLOBALS['server'] which is then reflected in the page output. Since this occurs in the global code and not within a named function, no specific vulnerable functions are identified. The fix applied htmlspecialchars to sanitize the input, confirming that the lack of output encoding in the parameter handling logic was the root cause. The absence of a dedicated function wrapping this logic results in an empty vulnerable_functions array.