In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter.
- https://packetstormsecurity.com/files/143357/Sitecore-CMS-8.2-Cross-Site-Scripting-File-Disclosure.html
No PoCs found on GitHub currently.