An issue exists in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter.
thinksaas thinksaas 2.91