What’s Vulnerable › Vulnerabilities

CVE-2021-26698

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-07-22 · updated 2026-06-17
• Weakness: CWE-79

Description

OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used.

Affected products

• Open-Xchange Appsuite: 7.10.3, 7.10.3-patch_release5547, 7.10.3-patch_release5572, 7.10.3-patch_release5623, 7.10.3-patch_release5653, 7.10.3-patch_release5677 (+50)

References

• http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html
• http://seclists.org/fulldisclosure/2021/Jul/33
• http://seclists.org/fulldisclosure/2021/Jul/33
• http://seclists.org/fulldisclosure/2021/Jul/33
• http://seclists.org/fulldisclosure/2021/Jul/33
• https://www.open-xchange.com
• http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html
• http://seclists.org/fulldisclosure/2021/Jul/33
• http://seclists.org/fulldisclosure/2021/Jul/33
• http://seclists.org/fulldisclosure/2021/Jul/33
• http://seclists.org/fulldisclosure/2021/Jul/33
• https://www.open-xchange.com

Get alerted when CVE-2021-26698 or the next vulnerability affects your stack