CVE-2022-3975: NukeView CMS vulnerable to Cross-site Scripting

The vulnerability report explicitly identifies filterAttr as the affected function. The commit diff shows: 1) Security checks were applied to raw attrSubSet[1] before HTML entity decoding, allowing encoded XSS payloads to bypass detection. 2) The patch moves unhtmlentities() before the data URL check and adds script tag filtering. The original flow made it vulnerable to encoded payloads in attributes, which matches the XSS vulnerability description. While other functions (filterTags) were modified in the commit, only filterAttr is explicitly called out in the CVE description as the vulnerable entry point.