CVE-2022-37306

OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.

• CWE-79
• CWE-79

• http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
• https://open-xchange.comProduct
• http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
• https://open-xchange.comProduct

Published

Apr 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37300A CWE-640: Weak Password Recovery Mechanism for Forgotten Pa…9.8
• CVE-2022-37301A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerabil…7.5
• CVE-2022-37302A CWE-119: Improper Restriction of Operations within the Bou…5.5
• CVE-2022-37303Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-37304Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-37305The Remote Keyless Entry (RKE) receiving unit on certain Hon…6.4
• CVE-2022-37307OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a…6.1
• CVE-2022-37308OX App Suite through 7.10.6 allows XSS via HTML in text/plai…6.1
• CVE-2022-37309OX App Suite through 7.10.6 allows XSS via script code withi…6.1
• CVE-2022-3731A vulnerability has been found in seccome Ehoney and classif…9.8
• CVE-2022-37310OX App Suite through 7.10.6 allows XSS via a malicious capab…6.1
• CVE-2022-37311OX App Suite through 7.10.6 has Uncontrolled Resource Consum…5.3