CVE-2023-26456 (published 2023-11-02T13:01:24.351Z)
Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. Sanitization is in place for product names now. No publicly available exploits are known.


Affected products: Vendor: OX Software GmbH
Product: OX App Suite
Versions: 0