CVE-2025-61997: fallo de gravedad media en OPEXUS FOIAXpress
OPEXUS FOIAXpress stored XSS via banner image
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.8epss 0.2%
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise Banner image upload field. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
OPEXUS · FOIAXpressCVEs relacionadas — OPEXUS FOIAXpress
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-62586HIGHOPEXUS FOIAXpress unauthenticated administrator password resetEPSS 0.7%CVE-2025-61999MEDIUMOPEXUS FOIAXpress stored XSS via logo imageEPSS 0.2%CVE-2025-61998MEDIUMOPEXUS FOIAXpress stored XSS via Hyperlink ManagerEPSS 0.2%CVE-2025-61996MEDIUMOPEXUS FOIAXpress stored XSS via annual report templateEPSS 0.2%