CVE-2026-129254
Deferred Deferred - Pending Action

Cross-Site Scripting in Opixido OCMS Admin TUI

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: VulDB

Description
A flaw has been found in Opixido OCMS up to b7c15660aba83d96677c1a9abaa69c082a24f21c. This impacts an unknown function of the file admin/TUI/index.php of the component Admin TUI. This manipulation of the argument img causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-129254
EUVD
EUVD-2026-125913

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opixido ocms to b7c15660aba83d96677c1a9abaa69c082a24f21c (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in Opixido OCMS. It exists in the admin/TUI/index.php file where the img parameter reflects user input without proper encoding. Attackers can inject malicious JavaScript that executes in the context of a victim's browser.

Detection Guidance

To detect this reflected XSS vulnerability in Opixido OCMS, monitor network traffic for requests to admin/TUI/index.php with the img parameter containing suspicious JavaScript code. Use tools like Burp Suite or OWASP ZAP to intercept and inspect requests. Check server logs for unusual parameters or payloads in the img argument.

Impact Analysis

An attacker could steal sensitive session cookies like gs_admin or PHPSESSID, gain unauthorized access to authenticated admin functions, or exfiltrate sensitive application data. The attack requires tricking a user into clicking a malicious link.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance violations if user data is compromised.

Mitigation Strategies

Immediately update Opixido OCMS to the latest version if available. If no update exists, implement input validation to sanitize the img parameter. Apply output encoding to prevent JavaScript execution. Harden session cookies by setting HttpOnly and Secure flags. Deploy a Content Security Policy to restrict inline scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...