CVE-2013-6997: Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange (OX) AppSuite 7.4.0 and earlier allow r...

Security readout for executives and security teams

Open-Xchange AppSuite 7.4.0 and earlier could let a remote attacker inject script or HTML through malicious email content or office documents. The business risk is account and session exposure when users view attacker-controlled content in the webmail/document interface. Organizations are likely exposed if they still run Open-Xchange AppSuite 7.4.0 or earlier, especially where users view HTML email or office documents through the suite. Treat as a cleanup priority for legacy Open-Xchange environments. It is not KEV-listed in the supplied data, but XSS in webmail/document workflows can expose users and should not remain in production. Mitigation focus: Inventory all Open-Xchange AppSuite deployments and versions.; Check Open-Xchange advisory and release notes for the exact fixed build.; Apply the vendor-supported update for affected AppSuite versions..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.