Loadbalancer.org Enterprise VA MAX prior to 8.3.3 has XSS because Apache HTTP Server logs are displayed.
loadbalancer enterprise va max