OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.
CWE-79, CWE-79