Nagios Log Server prior to 2.0.8 allows Reflected XSS via the username on the Login page.
nagios log server