fix: XSS via Test Server Management interface