CVE-2016-5740

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev5. JavaScript code can be used as part of ical attachments within scheduling E-Mails. This content, for example an appointment's location, will be presented to the user at the E-Mail App, depending on the invitation workflow. This code gets executed within the context of the user's current session. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).

• CWE-79

• http://packetstormsecurity.com/files/138700/Open-Xchange-App-Suite-7.8.2-Cross-Site-Scripting.htmlMitigation, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/539394/100/0/threaded
• http://www.securityfocus.com/bid/92922Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40378/Mitigation, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/138700/Open-Xchange-App-Suite-7.8.2-Cross-Site-Scripting.htmlMitigation, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/539394/100/0/threaded
• http://www.securityfocus.com/bid/92922Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40378/Mitigation, Third Party Advisory, VDB Entry

Published

Dec 15, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5733Multiple cross-site scripting (XSS) vulnerabilities in phpMy…
• CVE-2016-5734phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, an…
• CVE-2016-5735Integer overflow in the rwpng_read_image24_libpng function i…
• CVE-2016-5736The default configuration of the IPsec IKE peer listener in …
• CVE-2016-5737The Gerrit configuration in the Openstack Puppet module for …
• CVE-2016-5739The Transformation implementation in phpMyAdmin 4.0.x before…
• CVE-2016-5742SQL injection vulnerability in the XML-RPC interface in Mova…
• CVE-2016-5743Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Up…
• CVE-2016-5744Siemens SIMATIC WinCC 7.0 through SP3 and 7.2 allows remote …
• CVE-2016-5745F5 BIG-IP LTM systems 11.x before 11.2.1 HF16, 11.3.x, 11.4.…
• CVE-2016-5746libstorage, libstorage-ng, and yast-storage improperly store…
• CVE-2016-5747A security vulnerability in cookie handling in the http stac…