{"id":"CVE-2026-129254","kind":"vulnerability","aliases":["CVE-2026-129254"],"related":[],"title":"Opixido OCMS: admin TUI image argument allows cross-site scripting","description":"A flaw has been found in Opixido OCMS up to b7c15660aba83d96677c1a9abaa69c082a24f21c. This impacts an unknown function of the file admin/TUI/index.php of the component Admin TUI. This manipulation of the argument img causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"An unknown function in the Admin TUI page admin/TUI/index.php of Opixido OCMS does not sanitize the img argument, so attacker-supplied script can run in a browser. The exploit is published, and the attack can be started remotely.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Opixido OCMS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["opixido-ocms","other","php","self-hosted"],"not_affected_if":["admin-not-public","component-absent"],"how_to_check":"- Check whether your installation includes admin/TUI/index.php, for example with `ls admin/TUI/index.php` in the OCMS web root\n- Determine the installed commit; the affected range is up to `b7c15660aba83d96677c1a9abaa69c082a24f21c`, and the sources give no version numbers beyond that","fix":null,"status":"open","published_at":"2026-11-14T13:17:21+00:00","first_seen_at":"2026-11-14T13:28:09+00:00","triaged_at":"2026-11-14T13:29:10+00:00","updated_at":"2026-11-14T13:29:10+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-14T13:29:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Opixido OCMS: admin TUI image argument allows cross-site scripting","impact":"medium","summary":"An unknown function in the Admin TUI page admin/TUI/index.php of Opixido OCMS does not sanitize the img argument, so attacker-supplied script can run in a browser. The exploit is published, and the attack can be started remotely.","audience":"businesses","category":"other","nicknames":[],"who_cares":["opixido-ocms","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker script runs in an admin user's browser session","analyst_note":"Confirm whether a fixed commit or release exists and whether the admin TUI page requires authentication; check the NVD entry and the project repository for a patch.","how_to_check":"- Check whether your installation includes admin/TUI/index.php, for example with `ls admin/TUI/index.php` in the OCMS web root\n- Determine the installed commit; the affected range is up to `b7c15660aba83d96677c1a9abaa69c082a24f21c`, and the sources give no version numbers beyond that","plain_action":"","product_name":"Opixido OCMS","needs_analyst":true,"not_affected_if":["admin-not-public","component-absent"],"who_is_affected":"Sites running Opixido OCMS up to commit b7c15660aba83d96677c1a9abaa69c082a24f21c that expose the admin TUI page are affected. The product uses rolling releases, so the sources give no fixed version, and the vendor did not respond to early disclosure. Installations that do not include the Admin TUI component or keep the admin area off the internet are less exposed.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000787,"input_tokens":4642,"output_tokens":645,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129254':14A,17A '-2026':13A,16A 'admin':3A,33B,90C 'admin/tui/index.php':36B,86C 'affect':132C 'allow':7A 'argument':6A,45B,96C 'attack':48B,62B,103C 'attacker-suppli':47B 'avail':137C 'b7c15660aba83d96677c1a9abaa69c082a24f21c':77C 'browser':55B 'caus':98C 'compon':89C 'contact':141C 'contini':117C 'cross':9A,99C 'cross-sit':8A 'cve':12A,15A 'deliveri':118C 'detail':130C 'disclosur':145C 'earli':142C 'exploit':57B,109C 'file':85C 'flaw':68C 'found':71C 'function':30B,82C 'host':27B 'imag':5A 'img':44B,97C 'impact':79C 'initi':106C 'manipul':93C 'may':114C 'ocm':2A,22B,39B,74C 'ocms':19A 'opixido':1A,18A,21B,38B,73C 'opixido-ocm':20B 'page':35B 'php':24B 'product':126C 'publish':59B,112C 'releas':121C,135C 'remot':66B,107C 'respond':149C 'roll':120C 'run':52B 'sanit':42B 'script':11A,50B,101C 'self':26B 'self-host':25B 'site':10A,100C 'start':65B 'suppli':49B 'therefor':127C 'tui':4A,34B,91C 'unknown':29B,81C 'updat':134C 'use':116C,123C 'vendor':139C 'version':129C 'way':152C","nicknames":[],"mitigations":[],"who_affected":"Sites running Opixido OCMS up to commit b7c15660aba83d96677c1a9abaa69c082a24f21c that expose the admin TUI page are affected. The product uses rolling releases, so the sources give no fixed version, and the vendor did not respond to early disclosure. Installations that do not include the Admin TUI component or keep the admin area off the internet are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ocms","opixidoocms"],"ptokens":["ocms","opixido"],"labels":["medium","opixidoocms","other","php","selfhosted","vendor"],"campaign_type":null,"search_a":"'-129254':14A,17A '-2026':13A,16A 'admin':3A 'allow':7A 'argument':6A 'cross':9A 'cross-sit':8A 'cve':12A,15A 'imag':5A 'ocm':2A 'ocms':19A 'opixido':1A,18A 'script':11A 'site':10A 'tui':4A","search_b":"'admin':33B 'admin/tui/index.php':36B 'argument':45B 'attack':48B,62B 'attacker-suppli':47B 'browser':55B 'exploit':57B 'function':30B 'host':27B 'img':44B 'ocm':22B,39B 'opixido':21B,38B 'opixido-ocm':20B 'page':35B 'php':24B 'publish':59B 'remot':66B 'run':52B 'sanit':42B 'script':50B 'self':26B 'self-host':25B 'start':65B 'suppli':49B 'tui':34B 'unknown':29B","search_c":"'admin':90C 'admin/tui/index.php':86C 'affect':132C 'argument':96C 'attack':103C 'avail':137C 'b7c15660aba83d96677c1a9abaa69c082a24f21c':77C 'caus':98C 'compon':89C 'contact':141C 'contini':117C 'cross':99C 'deliveri':118C 'detail':130C 'disclosur':145C 'earli':142C 'exploit':109C 'file':85C 'flaw':68C 'found':71C 'function':82C 'img':97C 'impact':79C 'initi':106C 'manipul':93C 'may':114C 'ocm':74C 'opixido':73C 'product':126C 'publish':112C 'releas':121C,135C 'remot':107C 'respond':149C 'roll':120C 'script':101C 'site':100C 'therefor':127C 'tui':91C 'unknown':81C 'updat':134C 'use':116C,123C 'vendor':139C 'version':129C 'way':152C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T13:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129254","severity":null,"published_at":"2026-11-14T13:17:21+00:00","modified_at":"2026-11-14T13:17:21+00:00","first_seen_at":"2026-11-14T13:28:09+00:00","fetched_at":"2026-11-14T13:28:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}