All vulnerabilities
CVE-2026-12559

Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application

OpenText Vendor Invoice Management for SAP SolutionsApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published24 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting confidentiality and integrity of information processed through the application.

Text from CVE List

Affected versions 3

  • Vendor Invoice Management for SAP Solutionsaffected: VIM 7.6/20.4 through 0009CVE List
  • Vendor Invoice Management for SAP Solutionsaffected: VIM 23.4 through 0004CVE List
  • Vendor Invoice Management for SAP Solutionsaffected: VIM 25.4 through 0001CVE List

References 2