The Oracle Reports Server 10.g (9.0.4.3.3) is susceptible to cross site scripting attacks in an example jsp.