CVE-2017-18023: Improper Neutralization of Input During Web Page Generation

Office Tracker 11.2.5 has XSS via the logincount parameter to the /otweb/OTPClientLogin URI...