There are one or more XSS issues in Cell Manager.
I found it in OData View.

Steps of reproducing this problem is below:

1. Create OData in somewhere of your box.
2. Open the OData.
3. Create Entity Type and Add Property to the OData Scheme. (Type: String)
4. Add an entity which contians below code:

<script type="text/javascript">alert(JSON.parse(sessionStorage.getItem('sessionData')).access_token)</script>

The attacker using this vulnerability can get the user token stored in sessionStorage.