CVE-2018-15633
Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitr…
Published Dec 22, 2020 · updated Jun 17, 2026 · odoo odoo
Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames.
Timeline
Detection, updates, and resolution for this record.
Dec 22, 2020 · Catalog
Detected
Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames.
Jun 16, 2026 · Catalog
Updated
Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames.
Jun 17, 2026 · NIST NVD
Updated
Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames.
Affected
- cpe odoo/odooversion unspecified
Sources
- CVE.orgCVE-2018-15633
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-15633
30-day exploitation probability 0.9%
first.org - NIST NVDCVE-2018-15633
Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames.
nvd.nist.gov - Odoo SecurityCVE-2018-15633
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com