CVE-2026-32869: medium-severity vulnerability in OPEXUS eComplaint
OPEXUS eComplaint and eCASE XSS via Name of Organization field
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.1%
OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of the "Name of Organization" field when filling out case information. An authenticated attacker can inject an XSS payload which is executed in the context of a victim's session when they visit the case information page.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Related CVEs — OPEXUS eComplaint
In the same product, most dangerous first.
CVE-2026-22235HIGHOPEXUS eComplaint IDOREPSS 0.4%CVE-2026-32865CRITICALOPEXUS eComplaint and eCase insecure password resetEPSS 0.3%CVE-2026-32867MEDIUMOPEXUS eComplaint unauthenticated file uploadEPSS 0.2%CVE-2026-32868MEDIUMOPEXUS eComplaint and eCASE XSS via my informationEPSS 0.1%CVE-2026-32866MEDIUMOPEXUS eComplaint and eCase stored XSS via profile first and last nameEPSS 0.1%