A stored cross‑site scripting flaw exists in the OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. When an attacker can influence data stored by the application, the stored data is later rendered unescaped into web pages shown to users, allowing the attacker to run arbitrary JavaScript in the victim’s browser. This compromise can lead to theft or modification of information processed by the application and may also facilitate other attacks such as session hijacking if sensitive data is exposed.

The vulnerability affects installations of OpenText Vendor Invoice Management for SAP Solutions. No specific version range is supplied in the advisory; any deployment that incorporates the Capture Validation component is potentially vulnerable until the vendor issues a patch or an update that removes the flaw.

The vulnerability has a CVSS score of 7.3, indicating high severity. The EPSS score is not available in this advisory, so the likelihood of widespread exploitation is currently unknown, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred as web‑based: an attacker must deliver malicious input that is stored by the application and later viewed by a legitimate user. If successful, the victim’s browser will execute the injected script with the privileges of the application’s user context.