One-api latest suffers from a Stored Cross-Site Scripting (XSS) vulnerability in the system settings (other settings)，when add "<img src = 1 onerror = alert(/xss/)>" in Footer field. This vulnerability allows attackers to cheat other users by injecting malicious scripts into web pages viewed by other users.