Web Port 1.19.1 allows XSS via the /access/setup type parameter.