CVE-2026-32867: medium-severity vulnerability in OPEXUS eComplaint
OPEXUS eComplaint unauthenticated file upload
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'. Users would see these unexpected files in cases. Uploading a large number of files could consume storage.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
OPEXUS · eComplaintRelated CVEs — OPEXUS eComplaint
In the same product, most dangerous first.
CVE-2026-22235HIGHOPEXUS eComplaint IDOREPSS 0.4%CVE-2026-32865CRITICALOPEXUS eComplaint and eCase insecure password resetEPSS 0.3%CVE-2026-32869MEDIUMOPEXUS eComplaint and eCASE XSS via Name of Organization fieldEPSS 0.1%CVE-2026-32868MEDIUMOPEXUS eComplaint and eCASE XSS via my informationEPSS 0.1%