Open Source Social Network (OSSN) version 8.6 contains a Cross Site Scripting (XSS) vulnerability via the 'param' parameter at the endpoint u/administrator/friends. This vulnerability allows an attacker with low privileges and requiring user interaction to execute arbitrary code in the context of the affected user.