Authentication flaw

SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication...