PT-2026-2174 · Opexus · Opexus Ecase Audit

Aaron M. Ramirez + 3 · Publicado 2026-01-08 · Atualizado 2026-01-09 · CVE-2026-22232

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OPEXUS eCASE Audit versions prior to 11.14.2.0

Description OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the “A or SIC Number” field within the Project Setup functionality. This JavaScript is executed when another user views the project. The affected field is used for project setup and allows for the storage of malicious code. The A or SIC Number field is the entry point for this issue.

Recommendations Upgrade to OPEXUS eCASE Audit version 11.14.2.0 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-22232

Produtos afetados

Opexus Ecase Audit

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-22232 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2009482732032708788 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-22232 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-22232 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2009462346335588462 · Publicação no Twitter
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-01.json · Nota
• https://docs.opexustech.com/docs/oig/audit/eCase_Audit_Release_Notes_11.14.2.0.pdf · Nota
• https://t.me/CVEtracker/41751 · Publicação no Telegram