Stored Cross-Site Scripting Vulnerability in OpenText Vendor Invoice Management
CVE-2026-12559

7.3HIGH

Key Information:

Vendor

Opentext
Status
Vendor Invoice Management For SAP Solutions
Vendor
CVE Published:
24 September 2026

What is CVE-2026-12559?

A Stored Cross-Site Scripting (XSS) vulnerability has been discovered in the OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. This vulnerability occurs when unauthorized script content can be executed in a user's browser under specific conditions, leading to potential exposure of sensitive information and compromise of data integrity while using the application. Affected users may unwittingly interact with malicious scripts, emphasizing the importance of immediate mitigation and security updates.

Affected Version(s)

Vendor Invoice Management for SAP Solutions SAP Fiori VIM 7.6/20.4 <= 0009

Vendor Invoice Management for SAP Solutions SAP Fiori VIM 23.4 <= 0004

Vendor Invoice Management for SAP Solutions SAP Fiori VIM 25.4 <= 0001

References

https://support.opentext.com/csm?id=ot_kb_unauthenticated...
https://support.opentext.com/csm?id=kb_article_view&syspa...

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.