TravianZ through 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36995.json"