The WebTop package for NethServer 7 and 8 allows stored XSS (for example, via the Subject field if an e-mail message).
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')