OPEXUS FOIAXpress CVE-2025-61998

Exploitation requires an authenticated user with ADMINISTRATIVE privileges who can access the Technical Support Hyperlink Manager feature and store JavaScript/arbitrary content in place of a legitimate URL (PR:H). A second, limiting factor is required victim interaction (UI:P): another user must actively click the crafted technical support link for the payload to execute in their context. There is no remote-unauthenticated path - the attacker must already hold admin access to FOIAXpress before version 11.13.3.0. These two constraints (privileged injection + victim click) materially reduce realistic risk below what the 'network' attack vector alone would suggest.

This is a genuinely low-to-moderate priority issue despite the XSS classification. All signals align toward limited real-world urgency: the CVSS 4.0 base score is 4.8 (Medium), and the key gating metric is PR:H - exploitation requires an already-authenticated ADMINISTRATIVE user to inject the payload, which substantially narrows the threat model to insider abuse or a compromised/privileged account rather than an external attacker. UI:P further requires a victim to click the malicious link. The EPSS score of 0.24% (14th percentile) is low and consistent with the absence of any public exploit and the lack of CISA KEV listing - there is no evidence of active exploitation. Impact metrics are all 'Low' (VC:L/VI:L/VA:L), reflecting a stored-XSS style theft of session cookies/credentials rather than direct system compromise. The signals are internally consistent (high privilege requirement + low EPSS + no KEV/POC), so there is no conflicting data to reconcile; the main caveat is that the required attacker already holds administrative rights, meaning the vulnerability is primarily a privilege-boundary / trust-escalation concern (admin attacking other users) rather than a classic remote compromise.

A malicious or compromised administrative user of FOIAXpress enters JavaScript (instead of a legitimate URL) into the Technical Support Hyperlink Manager. When another user - such as a FOIA processor or lower-privileged operator - clicks the technical support link, the injected script runs in their browser session, allowing the attacker to steal session cookies, credentials, or sensitive FOIA data. No public proof-of-concept or exploit code has been identified at time of analysis.