Cross-Site Scripting in OPEXUS FOIAXpress Affects User Security
CVE-2025-61996

4.8MEDIUM

Key Information:

Vendor

Opexus

Status
Foiaxpress
Vendor
CVE Published:
7 October 2025

What is CVE-2025-61996?

OPEXUS FOIAXpress allows an administrative user to execute JavaScript or other unauthorized content within the Annual Report Template. When an affected user generates an Annual Report, the injected content is executed in their browser context. This vulnerability can lead to unauthorized actions being performed on behalf of users, such as stealing session cookies, user credentials, or other sensitive information, thereby jeopardizing user security.

Affected Version(s)

FOIAXpress 0 < 11.13.3.0

FOIAXpress 11.13.3.0

References

https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAX...
https://www.cve.org/CVERecord?id=CVE-2025-61996
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aaron M. Ramirez, United States Department of Justice
Wesley Cuffee, United States Department of Justice
.