YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16130.json"