Foiaxpress
Monthly
Remote unauthenticated attackers can reset the administrator password in OPEXUS FOIAXpress versions prior to 11.13.2.0, leading to full administrative compromise. The flaw (CWE-306) allows password reset without authentication over the network, and while EPSS indicates a low exploitation likelihood (0.72%), the CVSS 4.0 vector includes E:P, indicating proof-of-concept exploit code exists. The vendor has released a fix in version 11.13.2.0.
Stored cross-site scripting in OPEXUS FOIAXpress before 11.13.3.0 lets an authenticated administrative user upload an SVG logo containing embedded JavaScript or other active content, which is then rendered and executed in the browsers of other users who visit affected pages. A successful attack allows the malicious administrator to act on behalf of those victims - including stealing session cookies, credentials, or other sensitive data - but it requires high administrative privileges (PR:H) to reach the upload function and depends on victims actually loading the branded pages. No public exploit code or confirmed active exploitation has been identified, and EPSS rates the likelihood of exploitation very low at 0.24% (14th percentile); only unpatched deployments below 11.13.3.0 are affected.
Stored cross-site scripting in OPEXUS FOIAXpress before 11.13.3.0 allows an authenticated administrative user to place JavaScript or other active content into the Technical Support Hyperlink Manager, which then executes in another user's browser when that user clicks the crafted link. The issue requires two conditions: the attacker must already have administrative privileges, and a separate victim must interact with the malicious hyperlink, so the assessed risk is low-to-moderate rather than a broadly exploitable remote compromise. No public exploit was identified at time of analysis, and EPSS is 0.24% (14th percentile).
Stored cross-site scripting in OPEXUS FOIAXpress before 11.13.3.0 allows an authenticated administrative user to inject JavaScript or other content via the Annual Report Enterprise Banner image upload field, which then executes in the context of other users when they generate an Annual Report. Successful exploitation can let the attacker perform actions on behalf of the victim, including stealing session cookies, credentials, or sensitive data. Exploitation requires a high-privileged admin account to plant the payload and a separate victim user to trigger report generation; no public exploit code exists and EPSS is 0.24% (14th percentile), making this a low-to-moderate priority issue that is realistically an insider-abuse or post-admin-compromise scenario.
Stored cross-site scripting (CWE-79) in OPEXUS FOIAXpress before 11.13.3.0 lets an actor who already holds administrative access inject JavaScript or other markup into the Annual Report Template, which is then rendered and executed in the browser context of other users when they generate an Annual Report. Successful exploitation lets the administrative attacker act as the victim - stealing session cookies, credentials, or other sensitive data the victim can access - but the CVSS 4.0 vector (PR:H, UI:P) makes clear this requires high privilege on the attacker's side plus a separate, deliberate victim action, so it is not a self-triggering or remotely unauthenticated flaw. The EPSS score of 0.24% (14th percentile) and the absence of any public exploit code indicate low real-world likelihood of exploitation at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported.
Remote unauthenticated attackers can reset the administrator password in OPEXUS FOIAXpress versions prior to 11.13.2.0, leading to full administrative compromise. The flaw (CWE-306) allows password reset without authentication over the network, and while EPSS indicates a low exploitation likelihood (0.72%), the CVSS 4.0 vector includes E:P, indicating proof-of-concept exploit code exists. The vendor has released a fix in version 11.13.2.0.
Stored cross-site scripting in OPEXUS FOIAXpress before 11.13.3.0 lets an authenticated administrative user upload an SVG logo containing embedded JavaScript or other active content, which is then rendered and executed in the browsers of other users who visit affected pages. A successful attack allows the malicious administrator to act on behalf of those victims - including stealing session cookies, credentials, or other sensitive data - but it requires high administrative privileges (PR:H) to reach the upload function and depends on victims actually loading the branded pages. No public exploit code or confirmed active exploitation has been identified, and EPSS rates the likelihood of exploitation very low at 0.24% (14th percentile); only unpatched deployments below 11.13.3.0 are affected.
Stored cross-site scripting in OPEXUS FOIAXpress before 11.13.3.0 allows an authenticated administrative user to place JavaScript or other active content into the Technical Support Hyperlink Manager, which then executes in another user's browser when that user clicks the crafted link. The issue requires two conditions: the attacker must already have administrative privileges, and a separate victim must interact with the malicious hyperlink, so the assessed risk is low-to-moderate rather than a broadly exploitable remote compromise. No public exploit was identified at time of analysis, and EPSS is 0.24% (14th percentile).
Stored cross-site scripting in OPEXUS FOIAXpress before 11.13.3.0 allows an authenticated administrative user to inject JavaScript or other content via the Annual Report Enterprise Banner image upload field, which then executes in the context of other users when they generate an Annual Report. Successful exploitation can let the attacker perform actions on behalf of the victim, including stealing session cookies, credentials, or sensitive data. Exploitation requires a high-privileged admin account to plant the payload and a separate victim user to trigger report generation; no public exploit code exists and EPSS is 0.24% (14th percentile), making this a low-to-moderate priority issue that is realistically an insider-abuse or post-admin-compromise scenario.
Stored cross-site scripting (CWE-79) in OPEXUS FOIAXpress before 11.13.3.0 lets an actor who already holds administrative access inject JavaScript or other markup into the Annual Report Template, which is then rendered and executed in the browser context of other users when they generate an Annual Report. Successful exploitation lets the administrative attacker act as the victim - stealing session cookies, credentials, or other sensitive data the victim can access - but the CVSS 4.0 vector (PR:H, UI:P) makes clear this requires high privilege on the attacker's side plus a separate, deliberate victim action, so it is not a self-triggering or remotely unauthenticated flaw. The EPSS score of 0.24% (14th percentile) and the absence of any public exploit code indicate low real-world likelihood of exploitation at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported.