CVE-2025-61999

CVE-2025-61999 affects OPEXUS FOIAXpress before 11.13.3.0. An administrative user can upload an SVG image (logo) containing JavaScript or other content, causing stored XSS when other users view affected pages. This can enable the admin to perform actions on behalf of target users, including steal...

CVE-2025-61998

CVE-2025-61998 affects OPEXUS FOIAXpress versions before 11.13.3.0. A privileged (administrative) user can inject JavaScript/content into the Technical Support Hyperlink Manager; the injected payload executes in the context of other users when they click the link, enabling actions on behalf of th...

CVE-2025-61996

CVE-2025-61996 affects OPEXUS FOIAXpress prior to 11.13.3.0. An administrative user can inject JavaScript or other content into the Annual Report Template, with injected content executed in other users’ sessions when they generate an Annual Report. This constitutes a stored XSS exposure that coul...

CVE-2025-61997

CVE-2025-61997 : OPEXUS FOIAXpress versions before 11.13.3.0 are affected by a stored XSS via the Annual Report Banner image/upload field. An administrative user can inject JavaScript or content that is executed in the context of other users when they generate an Annual Report, enabling actions o...