In Symphony before 3.3.0 there is XSS in the Title under Post. The ID \articleTitle\ of this is stored in the \articleTitle\ JSON field and executes a payload when accessing the /member/test/points URI allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.