diff --git a/apps/routerconsole/java/src/net/i2p/router/web/helpers/NetDbRenderer.java b/apps/routerconsole/java/src/net/i2p/router/web/helpers/NetDbRenderer.java
index 94a9797ec..04c93048c 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/helpers/NetDbRenderer.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/helpers/NetDbRenderer.java
@@ -519,7 +519,7 @@ class NetDbRenderer {
                 buf.append("<b>").append(_t("Destination")).append(":</b> ");
                 TunnelPoolSettings in = _context.tunnelManager().getInboundSettings(key);
                 if (in != null && in.getDestinationNickname() != null)
-                    buf.append(in.getDestinationNickname());
+                    buf.append(DataHelper.escapeHTML(in.getDestinationNickname()));
                 else
                     buf.append(dest.toBase64().substring(0, 6));
                 buf.append("</th></tr>\n");
diff --git a/apps/routerconsole/jsp/debug.jsp b/apps/routerconsole/jsp/debug.jsp
index 6b2d07e54..c71739a2b 100644
--- a/apps/routerconsole/jsp/debug.jsp
+++ b/apps/routerconsole/jsp/debug.jsp
@@ -76,8 +76,18 @@
         net.i2p.data.Hash h = dest.calculateHash();
         net.i2p.crypto.SessionKeyManager skm = ctx.clientManager().getClientSessionKeyManager(h);
         if (skm != null) {
-            out.print("<div class=\"debug_section\" id=\"cskm" + (i++) + "\">");
-            out.print("<h2><font size=\"-2\">" + dest.toBase32() + "</font> Session Key Manager</h2>");
+            out.print("<div class=\"debug_section\" id=\"cskm" + (i++) + "\"><h2>");
+            net.i2p.router.TunnelPoolSettings tps = ctx.tunnelManager().getInboundSettings(h);
+            if (tps != null) {
+                String nick = tps.getDestinationNickname();
+                if (nick != null)
+                    out.print(net.i2p.data.DataHelper.escapeHTML(nick));
+                else
+                    out.print("<font size=\"-2\">" + dest.toBase32() + "</font>");
+            } else {
+                out.print("<font size=\"-2\">" + dest.toBase32() + "</font>");
+            }
+            out.print(" Session Key Manager</h2>");
             skm.renderStatusHTML(out);
             out.print("</div>");
         }