JavaScript Injection Vulnerability in OPEXUS FOIAXpress
CVE-2025-61998
4.8MEDIUM
What is CVE-2025-61998?
A JavaScript injection vulnerability exists in OPEXUS FOIAXpress prior to version 11.13.3.0, where an administrative user can insert malicious JavaScript or other content as a URL through the Technical Support Hyperlink Manager. When other users click on the malicious link, the injected content is executed in their context. This loophole allows the administrative user to perform actions impersonating the target user, potentially leading to the theft of session cookies, user credentials, or other sensitive information.
Affected Version(s)
FOIAXpress 0 < 11.13.3.0
FOIAXpress 11.13.3.0
References
CVSS V4
Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Aaron M. Ramirez, United States Department of Justice
Wesley Cuffee, United States Department of Justice