OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message.
- https://seclists.org/fulldisclosure/2022/Jul/11
No PoCs found on GitHub currently.