OX App Suite up to and including 7.10.6 allows XSS via appHandler in a deep link in an e-mail message.
open-xchange ox app suite