An issue exists in Zammad prior to 3.4.1. There is Stored XSS via a Tags element in a TIcket.
zammad zammad