CVE-2026-12559

HighCVSS 7.3/10Last modified Sep 24, 2026

Description

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting confidentiality and integrity of information processed through the application.

Metrics

CVSS 4.0 7.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:M/U:Red

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-12566.4The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all CVE-2026-125604.4The Editorial Rating – Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' Field CVE-2026-125616.4The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in all versions up to an CVE-2026-125628.8The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access CVE-2026-125649.6A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashiv CVE-2026-125655.3The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on th CVE-2026-125663.1The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint wit CVE-2026-125672.2The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local CVE-2026-125686.5The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. I CVE-2026-125699.8A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be ex CVE-2026-12577.5The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the CVE-2026-125705.5A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files