tianti 2.3 has stored XSS in the userlist module via the tianti-module-admin/user/ajax/save_role name parameter which is mishandled in tianti-module-admin\\src\\main\\webapp\\WEB-INF\\views\\user\\user_list.jsp.