Office Tracker 11.2.5 has XSS via the logincount parameter to the /otweb/OTPClientLogin URI.
officetracker officetracker 11.2.5