PT-2025-31567 · Opexus · Opexus Foiaxpress Public Access Link

Nathan Spidle · Published 2025-07-31 · Updated 2025-09-12 · CVE-2025-54834

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0

Description OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. The system lacks rate-limiting mechanisms.

Recommendations Apply measures to limit the rate of requests to the /App/CreateRequest.aspx endpoint. Implement authentication checks for access to the /App/CreateRequest.aspx endpoint.

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2025-54834

Affected Products

Opexus Foiaxpress Public Access Link

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-54834 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54834 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-54834 · Security Note
• https://t.me/CVEtracker/28884 · Telegram Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-174-01.json · Note
• https://t.me/cveNotify/135304 · Telegram Post
• https://docs.opexustech.com/docs/foiaxpress/11.12.0/FOIAXpress_Release_notes_11.12.3.0.pdf · Note
• https://twitter.com/CVEnew/status/1950976240057475494 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1950999113580875803 · Twitter Post