CVE-2016-6851

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.) in case the user has an active session on the same domain already.

• CWE-79

• http://packetstormsecurity.com/files/138701/Open-Xchange-Guard-2.4.2-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/539395/100/0/threaded
• http://www.securityfocus.com/bid/92920Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40377/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/138701/Open-Xchange-Guard-2.4.2-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/539395/100/0/threaded
• http://www.securityfocus.com/bid/92920Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40377/Exploit, Third Party Advisory, VDB Entry

Published

Dec 15, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6844An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6845An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6846Cross-site scripting (XSS) vulnerability in Open-Xchange (OX…
• CVE-2016-6847An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6848An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6850An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6852An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-6853An issue was discovered in Open-Xchange OX Guard before 2.4.…
• CVE-2016-6854An issue was discovered in Open-Xchange OX Guard before 2.4.…
• CVE-2016-6855Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3,…
• CVE-2016-6856Cross-site scripting (XSS) vulnerability in the Inbox Search…
• CVE-2016-6857Cross-site scripting (XSS) vulnerability in the Create Catal…