CVE-2021-23928

OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string.