OX App Suite up to and including 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.
open-xchange ox app suite