The Kossy module prior to 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling.