XSS bug in db.debian.org