CVE-2025-15591: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in OpenText Content Management

This vulnerability (CWE-79) involves improper neutralization of input during web page generation in the Forums feature of OpenText Content Management Content Server. An attacker could exploit this flaw to inject malicious scripts into forum pages, potentially impacting users who view these pages. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, and user interaction needed. There is no indication of known exploits in the wild or vendor-provided patches at this time.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the victim's browser when viewing the affected forum pages. This may lead to session hijacking, defacement, or other client-side impacts. However, the impact is rated medium and requires user interaction, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when interacting with forum content and consider applying any recommended workarounds from OpenText if available.