XSS might be possible when using a specific-crafted request (harder than previous ones). Might also easily cause JS errors and making the "mailcow UI"-logs not accessible anymore