CVE-2026-32868: OPEXUS eComplaint and eCASE XSS via my information
OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the 'My Information' screen. An authenticated attacker can inject parts of an XSS payload in the first and last name fields. The payload is executed when the full name is rendered. The attacker can run script in the context of a victim's session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32868?
CVE-2026-32868 is considered a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2026-32868?
To fix CVE-2026-32868, upgrade to OPEXUS eComplaint and eCASE version 10.2.0.0 or later, which includes proper sanitization of input fields.
What type of attack does CVE-2026-32868 enable?
CVE-2026-32868 enables authenticated attackers to perform cross-site scripting (XSS) attacks by injecting malicious scripts into the first and last name fields.
Who is affected by CVE-2026-32868?
Users of OPEXUS eComplaint and eCASE software versions prior to 10.2.0.0 are affected by CVE-2026-32868.
What are the consequences of CVE-2026-32868?
The consequences of CVE-2026-32868 can include unauthorized data access, session hijacking, and user impersonation due to XSS exploits.