Alfresco Enterprise prior to 5.2.5 allows stored XSS via an uploaded HTML document.
alfresco alfresco