Foiaxpress

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:opexus:foiaxpress:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorOpexus (399fd120-a70a-539f-9287-96058bb78107)
ProductFoiaxpress (065c2df2-3764-590d-8e66-94367d4ef27e)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-62586 vulnerable 2026-06-08 07:39:16.139203 OPEXUS FOIAXpress unauthenticated administrator password reset
CRITICAL (9.8)
OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0.
Published: 2025-10-16T17:20:09.156Z
Updated: 2026-02-26T16:57:25.629Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61999 vulnerable 2026-06-08 07:37:28.510257 OPEXUS FOIAXpress stored XSS via logo image
MEDIUM (4.3)
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedded in an SVG image used as a logo. Injected content is executed in the context of other users when they view affected pages. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
Published: 2025-10-07T23:14:38.171Z
Updated: 2025-10-10T19:38:46.491Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61998 vulnerable 2026-06-08 07:37:28.509787 OPEXUS FOIAXpress stored XSS via Hyperlink Manager
MEDIUM (4.3)
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager. Injected content is executed in the context of other users when they click the malicious link. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
Published: 2025-10-07T23:14:16.924Z
Updated: 2025-10-10T19:39:28.197Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61997 vulnerable 2026-06-08 07:37:28.509447 OPEXUS FOIAXpress stored XSS via banner image
MEDIUM (4.3)
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise Banner image upload field. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
Published: 2025-10-07T23:13:54.801Z
Updated: 2025-10-10T19:24:33.430Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61996 vulnerable 2026-06-08 07:37:28.508181 OPEXUS FOIAXpress stored XSS via annual report template
MEDIUM (4.3)
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
Published: 2025-10-07T23:13:31.625Z
Updated: 2025-10-10T19:21:56.233Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.