In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
Published December 11, 2025.
Jetbrains Teamcity