Stored XSS in the ticketing system