Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard.
advantech webaccess 8.4.2
advantech webaccess 8.4.4