CVE-2021-26698

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.htmlExploit, Mailing List, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Jul/33Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Jul/33Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Jul/33Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Jul/33Exploit, Mailing List, Third Party Advisory
https://www.open-xchange.comVendor Advisory
http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.htmlExploit, Mailing List, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Jul/33Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Jul/33Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Jul/33Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Jul/33Exploit, Mailing List, Third Party Advisory
https://www.open-xchange.comVendor Advisory

Timeline

Published: Jul 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-266995.4OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter CVE-2021-267007.8Visual Studio Code npm-script Extension Remote Code Execution Vulnerability CVE-2021-267018.1.NET Core Remote Code Execution Vulnerability CVE-2021-267026.1EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.CVE-2021-267039.8EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted JSON/XML input to a cgi/ajax/phrase CVE-2021-267048.8EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI.CVE-2021-267059.1An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without a CVE-2021-267069.8An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for CVE-2021-267079.8The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to i CVE-2021-267087.0A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are CVE-2021-267099.8D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to CVE-2021-267106.1A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript v