Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: OPEXUS Component: Ecase Ecomplaint Clear all filters
TI-2026-25330 CVE-2026-32869 · GHSA-qx35-58q7-q7x6

OPEXUS eComplaint and eCASE XSS via Name of Organization field

Priority LOW 22

OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of the "Name of Organization" field when filling out case information.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00147 Published 2026-03-19 Fixed in 10.2.0.0 CWE-79
TI-2026-25329 CVE-2026-32868 · GHSA-3g9r-2f6r-x6j2

OPEXUS eComplaint and eCASE XSS via my information

Priority LOW 22

OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the 'My Information' screen.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00147 Published 2026-03-19 Fixed in 10.2.0.0 CWE-79
TI-2026-25328 CVE-2026-32867 · GHSA-qw9c-jpw9-vj74

OPEXUS eComplaint unauthenticated file upload

Priority LOW 29

OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00201 Published 2026-03-19 Fixed in 10.1.0.0 CWE-425
TI-2026-25326 CVE-2026-32865 · GHSA-54h7-v9wj-85j9

OPEXUS eComplaint and eCase insecure password reset

Priority MEDIUM 42

OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00319 Published 2026-03-19 Fixed in 10.1.0.0 CWE-200
TI-2026-17845 CVE-2026-22235 · GHSA-v7w8-9cgx-wgv4

OPEXUS eComplaint IDOR

Priority HIGH 77

OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00352 Published 2026-01-08 Fixed in 9.0.45.0 CWE-639