Skip to content
OpenAdvisories

Vendor

OPEXUS

20 known vulnerabilities.

Products

FOIAXpress 5 eComplaint 5 eCASE 4 eCASE Audit 4 FOIAXpress Public Access Link (PAL) 4 eCase Portal 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-32865

    OPEXUS eComplaint and eCase insecure password reset

    OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password …

    OPEXUS eComplaint eCASE
  • Critical 9.8
    CVE-2026-22234

    OPEXUS eCasePortal unauthenticated IDOR

    OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files.

    OPEXUS eCase Portal
  • Critical 9.8
    CVE-2025-62586

    OPEXUS FOIAXpress unauthenticated administrator password reset

    OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0.

    OPEXUS FOIAXpress
  • Critical 9.8
    CVE-2025-58462

    OPEXUS FOIAXpress PAL SQL injection

    OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database.

    OPEXUS FOIAXpress Public Access Link (PAL)