CVE-2026-12559

critical

Description

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting confidentiality and integrity of information processed through the application.

References

https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0869044

https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0869040

Details

Source: Mitre, NVD

Published: 2026-09-24

Updated: 2026-09-24

Risk Information

CVSS v2

Base Score: 3.5

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N

Severity: Low

CVSS v3

Base Score: 5.4

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Severity: Medium

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H

Severity: Critical

EPSS

EPSS: 0.00386