PT-2026-26308 · Unknown · Opexus Ecase+1

Adam Rose · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-32866

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OPEXUS eComplaint and eCASE versions prior to 10.2.0.0

Description OPEXUS eComplaint and eCASE does not properly sanitize the first name and last name fields within a user profile. An authenticated attacker can inject parts of a cross-site scripting (XSS) payload into these fields. The injected payload is executed when a user’s full name is displayed. This allows the attacker to execute script in the context of a victim’s session.

Recommendations Update OPEXUS eComplaint and eCASE to version 10.2.0.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-32866

Affected Products

Opexus Ecase

Opexus Ecomplaint

References · 6

• https://cve.org/CVERecord?id=CVE-2026-32866 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32866 · Security Note
• https://twitter.com/VulmonFeeds/status/2034708458067341811 · Twitter Post
• https://twitter.com/CVEnew/status/2036024201770103144 · Twitter Post
• https://twitter.com/cyberbivash/status/2034677174255464817 · Twitter Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json · Note