Suffix of url-path is vulnerable to XSS-attack

How it was found

PoC http://smarthistory.khanacademy.org/Campin"><script>alert(/BigBear/)</script>.html

Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them.