CVE-2026-22235

CVE-2026-22235 affects OPEXUS eComplaint (and related eCasePortal) prior to version 9.0.45.0. The vulnerability arises from an information disclosure/IDOR flaw: an attacker can visit the DocumentOpen.aspx endpoint and iterate through predictable values of the chargeNumber parameter to download an...

CVE-2026-32868

CVE-2026-32868 affects OPEXUS eComplaint and eCASE prior to 10.2.0.0. The issue is improper sanitization of the first and last name fields on the My Information screen, enabling an authenticated attacker to inject an XSS payload that executes when the full name is rendered in the victim’s session...

CVE-2026-32865

Vulnerability summary: OPEXUS eComplaint/eCASE (pre-10.1.0.0) exposes the secret verification code in the HTTP response for ForcePasswordReset.aspx, enabling password reset by an attacker who knows a user’s email. Impact: attacker can reset password and security questions; existing security quest...

CVE-2026-32866

OPEXUS eComplaint and eCASE prior to version 10.2.0.0 are affected by a stored XSS vulnerability in profile name handling. An authenticated user can inject parts of an XSS payload into their first and last name fields, and the payload is executed when the full name is rendered, allowing script ex...

CVE-2026-32867

CVE-2026-32867 affects OPEXUS eComplaint prior to version 10.1.0.0. An unauthenticated attacker can obtain or guess an existing case number and upload arbitrary files through Portal/EEOC/DocumentUploadPub.aspx, causing unexpected files to appear in cases and potentially increasing storage usage. ...

CVE-2026-32869

CVE-2026-32869 affects OPEXUS eComplaint and eCASE prior to 10.2.0.0. The issue is improper sanitization of the Name of Organization field in case information, allowing an authenticated attacker to inject an XSS payload executed in the victim’s session when visiting the case information page. The...