lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI prior to 1.0.11 has XSS.
zonemaster zonemaster web gui