Administrator credential theft via stored category nickname

Stored XSS in FastAdmin 1.0.0.20200506_beta allows remote authenticated users to capture administrator credentials through category nicknames. The Category.php controller stores the category-management nickname without comprehensive filtering, so an administrator's browser executes injected script. Low-privileged access to edit a category nickname and an administrator viewing that entry are required; the script can expose administrator identity data.