In MISP before 2.4.172, titleforlayout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.