CVE-2018-15641

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-22 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes.

Affected products

Odoo: from 11.0 through 14.0

References

https://github.com/odoo/odoo/issues/63704
https://github.com/odoo/odoo/issues/63704

Get alerted when CVE-2018-15641 or the next vulnerability affects your stack