error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10307.json"