CVE-2025-61998: medium-severity vulnerability in OPEXUS FOIAXpress
OPEXUS FOIAXpress stored XSS via Hyperlink Manager
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8epss 0.2%
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager. Injected content is executed in the context of other users when they click the malicious link. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
OPEXUS · FOIAXpressRelated CVEs — OPEXUS FOIAXpress
In the same product, most dangerous first.
CVE-2025-62586HIGHOPEXUS FOIAXpress unauthenticated administrator password resetEPSS 0.7%CVE-2025-61999MEDIUMOPEXUS FOIAXpress stored XSS via logo imageEPSS 0.2%CVE-2025-61997MEDIUMOPEXUS FOIAXpress stored XSS via banner imageEPSS 0.2%CVE-2025-61996MEDIUMOPEXUS FOIAXpress stored XSS via annual report templateEPSS 0.2%