CVE-2022-1504: Cross-site Scripting in microweber

The XSS vulnerability stemmed from insufficient input sanitization in the module endpoint handler. The commit diff shows replacement of AntiXSS with a custom XSSClean class that adds protection against 80+ event handler attributes. The original AntiXSS implementation in module() only performed basic tag stripping and xss_clean(), but didn't block modern event handlers demonstrated in the test case (ontransitionrun=alert(1)). The vulnerable function directly processes the 'module' parameter from the URL without proper context-aware output encoding, making it susceptible to reflected XSS payloads.