OPIXIDO OCMS · CVE-2026-129254 · Other
NO FIX YET
An unknown function in the Admin TUI page admin/TUI/index.php of Opixido OCMS does not sanitize the img argument, so attacker-supplied script can run in a browser. The exploit is published, and the attack can be started remotely.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Opixido OCMS up to commit b7c15660aba83d96677c1a9abaa69c082a24f21c that expose the admin TUI page are affected. The product uses rolling releases, so the sources give no fixed version, and the vendor did not respond to early disclosure. Installations that do not include the Admin TUI component or keep the admin area off the internet are less exposed.
Not affected if admin-not-public, component-absent
Who cares opixido-ocms, php, self-hosted
ls admin/TUI/index.php in the OCMS web rootb7c15660aba83d96677c1a9abaa69c082a24f21c, and the sources give no version numbers beyond thatNo fix yet, per the sources.
A flaw has been found in Opixido OCMS up to b7c15660aba83d96677c1a9abaa69c082a24f21c. This impacts an unknown function of the file admin/TUI/index.php of the component Admin TUI. This manipulation of the argument img causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.