Vulnerabilities

TI-2025-34579 CVE-2025-54833 · GHSA-p9p4-h5gm-3hf5

OPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypass

LOW 37

OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00613 Published 2025-07-31 Fixed in 11.12.3.0 CWE-307

TI-2025-34580 CVE-2025-54834 · GHSA-989f-fh5x-8jw4

OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration

HIGH 70

OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00562 Published 2025-07-31 Fixed in 11.12.3.0 CWE-204

TI-2025-34578 CVE-2025-54832 · GHSA-w5m4-3739-7jcj

OPEXUS FOIAXpress Public Access Link (PAL) state and territory list unauthorized modification

MEDIUM 57

OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of states and territories.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00395 Published 2025-07-31 Fixed in 11.12.3.0 CWE-472

Vulnerabilities

Filters

OPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypass

OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration

OPEXUS FOIAXpress Public Access Link (PAL) state and territory list unauthorized modification