Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter the /icingaweb2/user/list query string the /icingaweb2/monitoring/timeline query string or the /icingaweb2/setup query string.