OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string.
Published January 13, 2021.
Open-xchange Open-xchange Appsuite