= 3.6.2
Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.