{"id":"CVE-2021-26263","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-26263","generatedAt":"2026-10-28T04:17:31.048Z","title":"Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.","description":"Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.","published":"2023-04-25T19:15:09.000Z","lastModified":"2026-06-17T03:43:02.000Z","status":"Modified","sourceIdentifier":"security@odoo.com","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["odoo/odoo"],"epss":{"score":0.00557,"percentile":0.46282,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.56%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/odoo/odoo/issues/107693","tags":["Issue Tracking","Patch","Vendor Advisory"],"source":"security@odoo.com"},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/107693","tags":["Issue Tracking","Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2023/dsa-5399","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-26263","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}