CVE-2025-15591: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in OpenText Content Management

CVE-2025-15591 describes a Cross-site Scripting (XSS) vulnerability in the Forums feature of OpenText Content Management Content Server. This vulnerability enables an attacker to inject malicious scripts into forum pages, which could be executed in the context of users viewing those pages. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction required, and low impact on confidentiality with no impact on integrity or availability. No known exploits or patches are currently documented.

Successful exploitation could allow an attacker to execute malicious scripts in the context of forum users, potentially leading to session hijacking, defacement, or other client-side impacts. However, the impact is rated as medium severity, indicating limited or controlled risk based on current information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should exercise caution when interacting with forum content and consider applying any available security controls that limit script execution or sanitize user input.