Description
OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. There are no rate-limiting mechanisms in place.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OPEXUS | FOIAXpress Public Access Link (PAL) | 11.1.0 – < 11.12.3.0 | 11.12.3.0 |
Advisories 1
- VA-25-174-01 OPEXUS FOIAXpress Public Access Link (PAL) multiple vulnerabilities CISA ICS & IT advisories · Sep 9, 2025