Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16639.json"
[ { "events": [ { "introduced": "0" }, { "last_affected": "5.1" } ] } ]