CVE-2026-129254: Opixido OCMS Admin TUI index.php cross site scripting

Published Nov 14, 2026

Updated

A flaw has been found in Opixido OCMS up to b7c15660aba83d96677c1a9abaa69c082a24f21c. This impacts an unknown function of the file admin/TUI/index.php of the component Admin TUI. This manipulation of the argument img causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

0 affected components

Event History

Nov 14, 2026

CVE Published

via MITRE·12:15 PM

Data Sourced

via MITRE·12:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attack can be initiated remotely and requires user interaction. No attacker privileges are required according to the provided severity vector.

Which deployments may be affected?

The issue affects the Admin TUI component, specifically admin/TUI/index.php, in Opixido OCMS revisions up to b7c15660aba83d96677c1a9abaa69c082a24f21c. Because the product uses rolling releases, no affected or fixed release versions are available.

Is public exploit information available?

Yes. An exploit has been published and may be used.

How can I determine whether my instance is exposed?

Check whether your deployment includes the Admin TUI file at admin/TUI/index.php and whether it is based on code at or before commit b7c15660aba83d96677c1a9abaa69c082a24f21c. The vulnerable behavior involves the img argument, but the provided information does not include a detection method or fixed revision.

CVE-2026-129254: Opixido OCMS Admin TUI index.php cross site scripting

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments may be affected?

Is public exploit information available?

How can I determine whether my instance is exposed?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments may be affected?

Is public exploit information available?

How can I determine whether my instance is exposed?