CVE-2021-25325: Improper Neutralization of Input During Web Page Generation

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...