PT-2025-41200 · Unknown · Opexus Foiaxpress

Aaron M. Ramirez + 1 · Published 2025-10-07 · Updated 2025-10-22 · CVE-2025-61998

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPEXUS FOIAXpress versions prior to 11.13.3.0

Description OPEXUS FOIAXpress before version 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager. This injected content is executed in the context of other users when they click the malicious link. Successful exploitation allows the administrative user to perform actions on behalf of the target, potentially including stealing session cookies, user credentials, or sensitive data.

Recommendations Update OPEXUS FOIAXpress to version 11.13.3.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-61998

Affected Products

Opexus Foiaxpress

References · 8

• https://cve.org/CVERecord?id=CVE-2025-61998 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61998 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61998 · Vendor Advisory
• https://t.me/cveNotify/137748 · Telegram Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-280-01.json · Note
• https://t.me/cveNotify/139854 · Telegram Post
• https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.3.0.pdf · Note
• https://t.me/CVEtracker/34390 · Telegram Post