CVE-2018-15634
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject ar…
Published Dec 22, 2020 · updated Jun 17, 2026 · odoo odoo
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.
Timeline
Detection, updates, and resolution for this record.
Dec 22, 2020 · Catalog
Detected
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.
Jun 16, 2026 · Catalog
Updated
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.
Jun 17, 2026 · NIST NVD
Updated
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.
Affected
- cpe odoo/odooversion unspecified
Sources
- CVE.orgCVE-2018-15634
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-15634
30-day exploitation probability 0.9%
first.org - NIST NVDCVE-2018-15634
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.
nvd.nist.gov - Odoo SecurityCVE-2018-15634
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com