CVE-2026-22235: high-severity vulnerability in OPEXUS eComplaint
OPEXUS eComplaint IDOR
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.4%
OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
OPEXUS · eComplaintRelated CVEs — OPEXUS eComplaint
In the same product, most dangerous first.
CVE-2026-32865CRITICALOPEXUS eComplaint and eCase insecure password resetEPSS 0.3%CVE-2026-32867MEDIUMOPEXUS eComplaint unauthenticated file uploadEPSS 0.2%CVE-2026-32869MEDIUMOPEXUS eComplaint and eCASE XSS via Name of Organization fieldEPSS 0.1%CVE-2026-32868MEDIUMOPEXUS eComplaint and eCASE XSS via my informationEPSS 0.1%