Skip to content
OpenAdvisories
Critical VA-25-252-01 1 CVE

OPEXUS FOIAXpress Public Access Link (PAL) SQL injection

Published Sep 9, 2025 · Updated Sep 9, 2025

Vendor: OPEXUS Product: FOIAXpress Public Access Link (PAL)

Summary

Successful exploitation could allow a remote, unauthenticated attacker to read, write, or delete any content in the underlying database.

Vulnerabilities 1

  • Critical 9.8
    CVE-2025-58462

    OPEXUS FOIAXpress PAL SQL injection

    OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database.

    OPEXUS FOIAXpress Public Access Link (PAL)

Revision history

  1. #1.0.0

    Initial publication