CVE-2018-15641

Timeline

Detection, updates, and resolution for this record.

1. Dec 22, 2020 · Catalog

   Detected

   Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes.

2. Jun 16, 2026 · Catalog

   Updated

   Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes.

3. Jun 17, 2026 · NIST NVD

   Updated

   Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes.

Affected

• cpe odoo/odooversion unspecified

Sources

• CVE.orgCVE-2018-15641

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2018-15641

  30-day exploitation probability 0.7%

  first.org
• NIST NVDCVE-2018-15641

  Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes.

  nvd.nist.gov
• Odoo SecurityCVE-2018-15641

  Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.

  github.com

References

• Patch · github.com