CVE-2018-15634
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject ar…
Published Dec 22, 2020 · updated Jun 16, 2026 · odoo odoo
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.
Timeline
Detection, updates, and resolution for this record.
Dec 22, 2020 · Catalog
Detected
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.
Jun 16, 2026 · Catalog
Updated
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.
Affected
- cpe odoo/odooversion unspecified
Sources
- NIST NVDCVE-2018-15634
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.
nvd.nist.gov - Odoo SecurityCVE-2018-15634
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com