CVE-2026-32869 | Medium | 5.5 | 2026-03-19 | OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of the "Name of Organization" field when filling out case information. An au… |
CVE-2026-32868 | Medium | 5.5 | 2026-03-19 | OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the 'My Information' screen. An authenticat… |
CVE-2026-32867 | Medium | 5.4 | 2026-03-19 | OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/… |
CVE-2026-32866 | Medium | 5.5 | 2026-03-19 | OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile. An authenticated attacker c… |
CVE-2026-32865 | Critical | 9.8 | 2026-03-19 | OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswo… |
CVE-2026-22235 | High | 7.5 | 2026-01-08 | OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber… |
CVE-2026-22234 | Critical | 9.8 | 2026-01-08 | OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable value… |
CVE-2026-22233 | Medium | 5.5 | 2026-01-08 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment in the "Estimated Staff Hours" field. The JavaScript is executed whenever a… |
CVE-2026-22232 | Medium | 5.5 | 2026-01-08 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is… |
CVE-2026-22231 | Medium | 5.5 | 2026-01-08 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality. The JavaScript is executed whe… |
CVE-2026-22230 | High | 7.6 | 2026-01-08 | OPEXUS eCASE Audit allows an authenticated attacker to modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disab… |
CVE-2025-62586 | Critical | 9.8 | 2025-10-16 | OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0. |
CVE-2025-61999 | Medium | 4.3 | 2025-10-08 | OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedded in an SVG image used as a logo. Injected conten… |
CVE-2025-61998 | Medium | 4.3 | 2025-10-08 | OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager… |
CVE-2025-61997 | Medium | 4.3 | 2025-10-08 | OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise Banner image upload… |
CVE-2025-61996 | Medium | 4.3 | 2025-10-08 | OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. Injected content is e… |
CVE-2025-58462 | Critical | 9.8 | 2025-09-09 | OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could r… |
CVE-2025-54834 | Medium | 5.3 | 2025-07-31 | OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check fo… |
CVE-2025-54833 | Medium | 5.3 | 2025-07-31 | OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers… |
CVE-2025-54832 | Medium | 4.3 | 2025-07-31 | OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of states and territories. |
CVE-2024-53553 | Critical | 9.1 | 2025-01-16 | An issue in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 allows attackers to bypass authentication via crafted web requests. |