JavaScript Injection Vulnerability in OPEXUS FOIAXpress by OPEXUS
CVE-2025-61997
4.8MEDIUM
What is CVE-2025-61997?
OPEXUS FOIAXpress versions prior to 11.13.3.0 are susceptible to a JavaScript injection vulnerability that allows an administrative user to upload malicious content in the Annual Report Enterprise Banner image upload field. When other users generate an Annual Report, this injected content can execute within their context. Successful exploitation can enable an administrative user to act on behalf of the target, leading to the potential theft of session cookies, user credentials, and other sensitive data.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
FOIAXpress 0 < 11.13.3.0
FOIAXpress 11.13.3.0
References
CVSS V4
Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Aaron M. Ramirez, United States Department of Justice
Wesley Cuffee, United States Department of Justice