OPEXUS FOIAXpress CVE-2025-61999

Exploitation requires an authenticated administrative user account in FOIAXpress with the ability to upload the application logo image, and the injected SVG/JavaScript only executes when other users subsequently view pages that render that logo (user interaction / passive victim browsing, UI:P). The principal limiting factors are the administrative privilege requirement (PR:H) - anonymous or low-privileged attackers cannot reach the upload function - and the dependency on victim users actually loading the affected pages; versions 11.13.3.0 and later are patched, so only unpatched deployments are affected.

This is a stored cross-site scripting (CWE-79) issue with a modest real-world risk profile, and the signals are internally consistent rather than conflicting. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L) yields a base score of only 4.8 (Medium), and the key limiter is PR:H - exploitation requires an already-privileged administrative account, so this is a privilege-escalation/trust-abuse path rather than a path for anonymous remote attackers. EPSS reinforces the low-urgency picture at 0.24% (14th percentile), indicating a very low modeled probability of near-term mass exploitation. The vulnerability is NOT listed in CISA KEV and there is no public exploit identified at time of analysis, so exploitation status is 'no public exploit identified at time of analysis.' Taken together, the signals agree: this is a legitimate security defect worth patching but not an emergency - the attacker must first hold administrative access, the payload only fires when other users view the affected page (UI:P), and impact is rated Low across confidentiality, integrity, and availability. A patched release (11.13.3.0) is available, so remediation is straightforward. The main residual concern is a malicious or compromised administrator escalating laterally to other users' sessions, not opportunistic internet-wide attack.

A malicious or compromised administrative user of FOIAXpress uploads an SVG 'logo' containing embedded JavaScript. When other users (including higher-trust operators or FOIA processors) subsequently load pages that render that logo, the script executes in their browser session, letting the attacker steal session cookies, credentials, or sensitive FOIA case data. No public proof-of-concept is known, and exploitation depends on both administrative access to upload the asset and victim users viewing the affected pages.