≤ 7.10.6
OX App Suite through 7.10.6 allows XSS by forcing block-wise read.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.