CVE-2021-37403

OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used.

• CWE-79

• http://seclists.org/fulldisclosure/2021/Jul/33Mailing List, Not Applicable, Third Party Advisory
• https://www.open-xchange.comVendor Advisory
• http://seclists.org/fulldisclosure/2021/Jul/33Mailing List, Not Applicable, Third Party Advisory
• https://www.open-xchange.comVendor Advisory

Published

Jul 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37393In RPCMS v1.8 and below, the "nickname" variable is not prop…5.4
• CVE-2021-37394In RPCMS v1.8 and below, attackers can interact with API and…8.8
• CVE-2021-3740A Session Fixation vulnerability exists in chatwoot/chatwoot…6.8
• CVE-2021-37400An attacker may obtain the user credentials from the communi…9.8
• CVE-2021-37401An attacker may obtain the user credentials from file server…9.8
• CVE-2021-37402OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-re…6.1
• CVE-2021-37404There is a potential heap buffer overflow in Apache Hadoop l…9.8
• CVE-2021-37405Rejected reason: This is unused.
• CVE-2021-37409Improper access control for some Intel(R) PROSet/Wireless Wi…7.8
• CVE-2021-3741A stored cross-site scripting (XSS) vulnerability was discov…5.4
• CVE-2021-37412The TechRadar app 1.1 for Confluence Server allows XSS via t…6.1
• CVE-2021-37413GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerab…9.8