CVE-2026-12559

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting confidentiality and integrity of information processed through the application.

CVSS

No CVSS.

References

Link	Resource
https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0869040
https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0869044

Configurations

No configuration.

History

24 Sep 2026, 15:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-24 15:17

Updated : 2026-09-24 20:43

NVD link : CVE-2026-12559

Mitre link : CVE-2026-12559

CVE.ORG link : CVE-2026-12559

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-12559", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12559", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-24T14:51:19.732789Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@opentext.com", "cvssData": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "USER", "baseScore": 7.3, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:M/U:Red", "exploitMaturity": "UNREPORTED", "providerUrgency": "RED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@opentext.com", "affectedData": [{"vendor": "OpenText", "modules": ["SAP Fiori Capture Validation application"], "product": "Vendor Invoice Management for SAP Solutions", "versions": [{"status": "affected", "version": "VIM 7.6/20.4", "versionType": "custom", "lessThanOrEqual": "0009"}, {"status": "affected", "version": "VIM 23.4", "versionType": "custom", "lessThanOrEqual": "0004"}, {"status": "affected", "version": "VIM 25.4", "versionType": "custom", "lessThanOrEqual": "0001"}], "platforms": ["SAP Fiori"], "defaultStatus": "unaffected"}]}], "published": "2026-09-24T15:17:18.350", "references": [{"url": "https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0869040", "source": "security@opentext.com"}, {"url": "https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0869044", "source": "security@opentext.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security@opentext.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting confidentiality and integrity of information processed through the application."}], "lastModified": "2026-09-24T20:43:32.537", "sourceIdentifier": "security@opentext.com"}