Cross Site Scripting Vulnerability in Opixido OCMS Admin TUI Component
CVE-2026-129254

5.3MEDIUM

Key Information:

Vendor

Opixido

Status
Ocms
Vendor
CVE Published:
14 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-129254?

A vulnerability has been identified in Opixido OCMS affecting its Admin TUI component. An issue exists in the 'admin/TUI/index.php' file, where improper handling of input within an unknown function allows for cross site scripting (XSS) attacks. This vulnerability can be exploited remotely, enabling attackers to inject malicious scripts, which could lead to unauthorized access or data exposure. The product employs a continuous delivery method with rolling releases, which complicates tracking specific affected versions. Despite early notification, Opixido has not responded to this security issue.

Affected Version(s)

OCMS b7c15660aba83d96677c1a9abaa69c082a24f21c

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-129254 - Proof of Concept

CVE-2026-129254
Created by Usama-Hanif131

References

https://vuldb.com/vuln/437282
vdb-entrytechnical-description
https://vuldb.com/vuln/437282/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-129254
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Usama Hanif
Usama_Hanif (VulDB User)
Usama_Hanif (VulDB User)
VulDB CNA Team
.