Fat Free CRM prior to 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
fatfreecrm fat free crm