index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name.
typesettercms typesetter 5.1