OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string.

By admin