our enterprise security scanner reported a cross-site scripting vulnerability for the AjaxUploader.  What it was able to do was modify the UploadOK() handler script to include a textarea and more scripting:   <script ...