Odoo <= 15.0 - Cross-Site Scripting
CVE-2021-26947
Verified
Description
A cross-site scripting (XSS) vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of the user's browser session.
Severity
Medium
CVSS Score
6.1
Exploit Probability
1%
Affected Product
odoo
Published Date
April 20, 2026
Template Author
ritikchaddha
CVE-2021-26947.yaml
6.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2021-26947
CWE ID:
cwe-79
Remediation Steps
Update to the latest version of Odoo where the vulnerability is fixed or apply security patches that sanitize user inputs properly.