Read the docs
TI-2025-38801 Aliases CVE-2025-62586GHSA-qv43-9jp8-2mv7

OPEXUS FOIAXpress unauthenticated administrator password reset

Priority MEDIUM 48CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0072 54th percentileScored 2026-11-07
Fix Fixed FOIAXpress (OPEXUS): 11.13.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OPEXUSFOIAXpress11.1.0 to before 11.13.2.011.13.2.0Patch availableCNA
  • FOIAXpress VendorOPEXUS Affected 11.1.0 to before 11.13.2.0 Fixed in 11.13.2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:opexustech:foiaxpress:*:*:*:*:*:*:*:*11.1.0 to before 11.13.2.0VulnerableOPEXUS
  • cpe:2.3:a:opexustech:foiaxpress:*:*:*:*:*:*:*:* Versions 11.1.0 to before 11.13.2.0 Vulnerable ·OPEXUS

Remediation

  • Fix · CNA FOIAXpress (OPEXUS) Fixed in 11.13.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62586
  2. 2026-10-03 Alias added: GHSA-qv43-9jp8-2mv7

References

Advisory 2

Other 1

  • TI-2025-38322 OPEXUS FOIAXpress stored XSS via logo image CVSS 4.0MEDIUM 4.8
  • TI-2025-38321 OPEXUS FOIAXpress stored XSS via Hyperlink Manager CVSS 4.0MEDIUM 4.8
  • TI-2025-38320 OPEXUS FOIAXpress stored XSS via banner image CVSS 4.0MEDIUM 4.8
  • TI-2025-38319 OPEXUS FOIAXpress stored XSS via annual report template CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences