PT-2025-41199 · Unknown · Opexus Foiaxpress

Aaron M. Ramirez + 1 · Published 2025-10-07 · Updated 2025-10-22 · CVE-2025-61997

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPEXUS FOIAXpress versions prior to 11.13.3.0

Description An administrative user can inject JavaScript or other content into the Annual Report Enterprise Banner image upload field. This injected content is executed when other users generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target user, potentially including the theft of session cookies, user credentials, or sensitive data. The issue involves a stored cross-site scripting (XSS) condition.

Recommendations Update OPEXUS FOIAXpress to version 11.13.3.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-61997

Affected Products

Opexus Foiaxpress

References · 8

• https://osv.dev/vulnerability/CVE-2025-61997 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-61997 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61997 · Security Note
• https://t.me/cveNotify/137747 · Telegram Post
• https://t.me/CVEtracker/34389 · Telegram Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-280-01.json · Note
• https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.3.0.pdf · Note
• https://t.me/cveNotify/139853 · Telegram Post