TranzWare (POI) FIMI prior to 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).
compassplus tranzware fimi