CVE-2021-26263

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Odoo	Odoo Community	>= 14.0, <= 15.0
Odoo	Odoo Enterprise	>= 14.0, <= 15.0
odoo	odoo_community	>= 14.0, <= 15.0
odoo	odoo_enterprise	>= 14.0, <= 15.0

References

https://github.com/odoo/odoo/issues/107693Issue Tracking, Patch, Vendor Advisory
https://www.debian.org/security/2023/dsa-5399
https://github.com/odoo/odoo/issues/107693Issue Tracking, Patch, Vendor Advisory
https://www.debian.org/security/2023/dsa-5399

Timeline

Published: Apr 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-262645.5A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-ser CVE-2021-262667.5cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).CVE-2021-262677.5cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).CVE-2021-262716.5It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles in CVE-2021-262726.5It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the CVE-2021-262737.8The Agent in NinjaRMM 5.0.909 has Incorrect Access Control.CVE-2021-262747.1The Agent in NinjaRMM 5.0.909 has Insecure Permissions.CVE-2021-262759.8The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnera CVE-2021-262765.3scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set comma CVE-2021-262779.8The framework service handles pendingIntent incorrectly, allowing a malicious application with certain privileges to perform privileged acti CVE-2021-262786.3The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device.CVE-2021-262795.9Some parameters of the weather module are improperly stored, leaking some sensitive information.