Vulnerability · Published Sep 24, 2026 · Assigned by OpenText
CVE-2026-12559Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application
High 7.3
In plain English
A high-severity cross-site scripting in Vendor Invoice Management for SAP Solutions from OpenText. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting confidentiality and integrity of information processed through the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenText | Vendor Invoice Management for SAP Solutions | VIM 7.6/20.4 – through 0009VIM 23.4 – through 0004VIM 25.4 – through 0001 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/S:N/AU:N/R:U/V:D/RE:M/U:Red