NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class (CVE-2026-41147) | HOL Guard CVE