Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py.
CWE-79