In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.