Services/Feeds/classes/class.ilExternalFeedItem.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a link attribute.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11117.json"