PT-2026-26310 · Unknown · Opexus Ecase+1

Adam Rose · Publicado 2026-03-19 · Atualizado 2026-03-23 · CVE-2026-32868

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OPEXUS eComplaint and eCASE versions prior to 10.2.0.0

Description OPEXUS eComplaint and eCASE does not properly sanitize input in the first and last name fields within the 'My Information' screen. An authenticated attacker can inject parts of a cross-site scripting (XSS) payload into these fields. This payload is then executed when a victim views the full name, allowing the attacker to run script within the context of the victim’s session. The vulnerable fields are the first name and last name fields.

Recommendations Update OPEXUS eComplaint and eCASE to version 10.2.0.0 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-32868

Produtos afetados

Opexus Ecase

Opexus Ecomplaint

Referências · 6

• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json · Nota
• https://twitter.com/CVEnew/status/2036024199974957423 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2034711017964392767 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-32868 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-32868 · Nota de Segurança
• https://twitter.com/cyberbivash/status/2034676874886975884 · Publicação no Twitter