IDURAR (aka idurar-erp-crm) up to and including 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.
idurar project idurar