CVE-2026-12559CWE-79cross-site-scripting

CVE-2026-12559

published September 24, 2026

CVSS
7.3
EPSS
0%
Percentile
31.5
In the wild
Unconfirmed
What it is

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting confidentiality and integrity of information processed through the application.

The record
Technical detail
CVSS
7.3 · NONE
CVSS v4.0
7.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/S:N/AU:N/R:U/V:D/RE:M/U:Red
EPSS
0.00386 · 31.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-24T19:17Z
References (2)
https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0869040 · [email protected]https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0869044 · [email protected]
EPSS history
Timeline
  • 26 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 24 SEP 14:18Z
    Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application
    cvelistv5