PT-2025-41198 · Opexus · Opexus Foiaxpress

Aaron M. Ramirez + 1 · Published 2025-10-07 · Updated 2025-10-22 · CVE-2025-61996

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPEXUS FOIAXpress versions prior to 11.13.3.0

Description An administrative user can inject JavaScript or other content into the Annual Report Template. This injected content is executed when other users generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.

Recommendations Update OPEXUS FOIAXpress to version 11.13.3.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-61996

Affected Products

Opexus Foiaxpress

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-61996 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61996 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-61996 · Security Note
• https://t.me/cveNotify/137746 · Telegram Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-280-01.json · Note
• https://t.me/cveNotify/139852 · Telegram Post
• https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.3.0.pdf · Note
• https://t.me/CVEtracker/34388 · Telegram Post