PT-2025-41201 · Unknown · Opexus Foiaxpress

Aaron M. Ramirez + 1 · Published 2025-10-07 · Updated 2025-10-22 · CVE-2025-61999

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPEXUS FOIAXpress versions prior to 11.13.3.0

Description An administrative user can upload JavaScript or other content embedded within an SVG image used as a logo. This injected content is executed when other users view affected pages. Successful exploitation allows the administrative user to perform actions on behalf of the target user, including stealing session cookies, user credentials, or sensitive data.

Recommendations Update to version 11.13.3.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-61999

Affected Products

Opexus Foiaxpress

References · 9

• https://cve.org/CVERecord?id=CVE-2025-61999 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61999 · Security Note
• https://t.me/CVEtracker/34391 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1975757438247711118 · Twitter Post
• https://t.me/cveNotify/137749 · Telegram Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-280-01.json · Note
• https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.3.0.pdf · Note
• https://t.me/cveNotify/139855 · Telegram Post