Total vulnerabilities in the database
Vanilla before 2.6.1 allows XSS via the email field of a profile.
CVSS v3:
CVSS v2:
CWEs:
OWASP TOP 10: