Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-20806.json"