Open Ticket Request System (OTRS) 6.0.x prior to 6.0.13 allows an admin to conduct an XSS attack via a modified URL.
otrs open ticket request system