Zimbra Collaboration prior to 8.6.0 patch5 has XSS.
synacor zimbra collaboration server
synacor zimbra collaboration server 8.6.0