XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php.
{ "ubuntu_priority": "medium" }