XML form vulnerability document is now the default.