An issue exists in Eventum 3.5.0. htdocs/switch.php has XSS via the current_page parameter.
eventum project eventum