CVE-2025-61996: OPEXUS FOIAXpress stored XSS via annual report template
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61996?
CVE-2025-61996 is considered a critical vulnerability due to the potential for remote JavaScript injection and execution.
How do I fix CVE-2025-61996?
To fix CVE-2025-61996, upgrade OPEXUS FOIAXpress to version 11.13.3.0 or later.
Who is affected by CVE-2025-61996?
Administrative users of OPEXUS FOIAXpress versions prior to 11.13.3.0 are affected by CVE-2025-61996.
What impact does CVE-2025-61996 have on users?
CVE-2025-61996 allows injected content to execute in the context of other users when generating Annual Reports.
Is CVE-2025-61996 being actively exploited?
As of the latest information, there is no specific indication that CVE-2025-61996 is being actively exploited in the wild.