CVE-2018-15638
Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary we…
Published Dec 22, 2020 · updated Jun 16, 2026 · odoo odoo
Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names.
Timeline
Detection, updates, and resolution for this record.
Dec 22, 2020 · Catalog
Detected
Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names.
Jun 16, 2026 · Catalog
Updated
Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names.
Affected
- cpe odoo/odooversion unspecified
Sources
- NIST NVDCVE-2018-15638
Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names.
nvd.nist.gov - Odoo SecurityCVE-2018-15638
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com