CVE-2026-22232mediumCWE-79

CVE-2026-22232: medium-severity vulnerability in OPEXUS eCASE Audit

OPEXUS eCASE Audit Project Setup stored XSS

Published

Follow this CVE+ Monitor eCASE Audit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.2%
OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is executed whenever another user views the project. Fixed in OPEXUS eCASE Audit 11.14.2.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
OPEXUS · eCASE Audit
Related CVEs — OPEXUS eCASE Audit

In the same product, most dangerous first.

CVE-2026-22230HIGHOPEXUS eCASE Audit incorrect access controlEPSS 0.3%CVE-2026-22233MEDIUMOPEXUS eCASE Audit Project Cost stored XSSEPSS 0.2%CVE-2026-22231MEDIUMOPEXUS eCASE Audit Document Check Out stored XSSEPSS 0.2%