In JetBrains TeamCity prior to 2023.05 possible XSS in the Plugin Vendor URL was possible
jetbrains teamcity