Technical impact
A reflected cross‑site scripting flaw exists in Opixido OCMS’s Admin TUI component. The vulnerability is triggered when the img argument in admin/TUI/index.php is accepted without proper sanitization. If an attacker supplies a malicious value, the resulting JavaScript will be injected into the admin page rendered by the application.
Affected Systems
All Opixido OCMS releases up to the commit b7c15660a are vulnerable. Because the product uses a rolling‑release model, no fixed version number is available. The flaw remains present until the vendor releases a patch or an internal update is applied.
Risk and Exploitability
The CVSS base score of 5.3 indicates moderate risk. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can initiate the exploit remotely by sending a crafted request to the admin/TUI interface. Proof‑of‑concept examples have been published, demonstrating the practicality of the attack. The flaw could allow a malicious script to execute in the context of a user who views the affected page; however, the exact execution scope is not explicitly stated in the CVE data, and this assertion is inferred from the nature of reflected XSS.
