Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter.

Source