Vulnerability · Published Nov 27, 2025 · Assigned by OX
CVE-2025-59025
Medium 6.1
In plain English
A medium-severity cross-site scripting in OX App Suite from Open-Xchange GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 88.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Sanitization has been updated to avoid such bypasses. No publicly available exploits are known
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open-Xchange GmbH | OX App Suite | 0 – through 8.35.1100 – through 8.39.850 – through 8.40.730 – through 8.41.50 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N