CVE-2017-15682: Cross site scripting in Crafter CMS

The security patch adds @ResponseBody annotations to force structured format responses (JSON/XML) instead of HTML. This indicates the vulnerability existed in these exception handlers when they returned HTML responses containing unescaped user-controlled data from exceptions. Attackers could trigger these exceptions with malicious input that would execute in the admin panel. The pre-patch versions of these methods would appear in runtime profiles when handling malicious requests that trigger exceptions containing XSS payloads.