PT-2026-2177 · Unknown · Opexus Ecomplaint

Zach Crosman · Published 2026-01-08 · Updated 2026-02-18 · CVE-2026-22235

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions OPEXUS eComplaint versions prior to 9.0.45.0

Description The application allows an attacker to access the 'DocumentOpen.aspx' endpoint and potentially download any uploaded files. This is possible by iterating through predictable values of the chargeNumber parameter.

Recommendations Update OPEXUS eComplaint to version 9.0.45.0 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-22235

Affected Products

Opexus Ecomplaint

References · 8

• https://osv.dev/vulnerability/CVE-2026-22235 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22235 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22235 · Security Note
• https://twitter.com/CVEnew/status/2009462342850105845 · Twitter Post
• https://t.me/cveNotify/152319 · Telegram Post
• https://t.me/CVEtracker/41754 · Telegram Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-02.json · Note
• https://twitter.com/VulmonFeeds/status/2009477611945079190 · Twitter Post