Atlassian Confluence Server prior to 5.9.11 has XSS on the viewmyprofile.action page.
atlassian confluence