Description
OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OPEXUS | FOIAXpress Public Access Link (PAL) | < 11.13.1.0 | 11.13.1.0 |
Advisories 1
- VA-25-252-01 OPEXUS FOIAXpress Public Access Link (PAL) SQL injection CISA ICS & IT advisories · Sep 9, 2025