Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8876.json"