Skip to content
OpenAdvisories

Product · OPEXUS

eComplaint

5 known vulnerabilities.

eComplaint at a glance

Last 12 months
5
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 4 vulnerabilities, 1 critical Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202641
Feb 202600
Jan 202610
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Latest advisories

  • Critical max 9.8
    VA-26-077-01 5 CVEs

    OPEXUS eComplaint and eCase multiple vulnerabilities

    OPEXUS eComplaint and eCase contain multiple vulnerabilities. In the worst case, an unauthenticated attacker could take over any account with a known username.

    OPEXUS
  • Critical max 9.8
    VA-26-008-02 2 CVEs

    OPEXUS eComplaint and eCasePortal IDOR

    OPEXUS eCasePortal and eComplaint before version 9.0.45.0 allow an unauthenticated attacker to iterate through predictable URL parameters and download all available files. The eCasePortal vulnerability allows attackers to upload and delete files as well.

    OPEXUS
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 5.5
    CVE-2026-32869

    OPEXUS eComplaint and eCASE XSS via Name of Organization field

    OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of the "Name of Organization" field when filling out case information. An authenticated attacker can inject an XSS payload which is executed in the context of a victim's sessio…

    OPEXUS eComplaint eCASE
  • Medium 5.5
    CVE-2026-32868

    OPEXUS eComplaint and eCASE XSS via my information

    OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the 'My Information' screen. An authenticated attacker can inject parts of an XSS payload in the first and last name fields. The payload is exe…

    OPEXUS eComplaint eCASE
  • Medium 5.4
    CVE-2026-32867

    OPEXUS eComplaint unauthenticated file upload

    OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'. Users would see these unexpected files in cases. Uploading a large num…

    OPEXUS eComplaint
  • Critical 9.8
    CVE-2026-32865

    OPEXUS eComplaint and eCase insecure password reset

    OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password …

    OPEXUS eComplaint eCASE
  • High 7.5
    CVE-2026-22235

    OPEXUS eComplaint IDOR

    OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files.

    OPEXUS eComplaint