CVE-2025-59025 — Cross-site Scripting in Gmbh OX APP Suite

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.1%
top 83.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Open-xchange Gmbh OX APP Suite
Timeline
PublishedNov 27

Description

Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Sanitization has been updated to avoid such bypasses. No publicly available exploits are known

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶CVEListV5open-xchange_gmbh/ox_app_suite8.35.110+3

🔴Vulnerability Details

2
GHSA
GHSA-4jpj-786v-c33m: Malicious e-mail content can be used to execute script code↗2025-11-27
▶
CVEList
CVE-2025-59025: Malicious e-mail content can be used to execute script code↗2025-11-27
▶
CVE-2025-59025 — Cross-site Scripting | cvebase