OPEXUS vulnerabilities
We track 7 vulnerabilities in OPEXUS products across 5 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on March 19, 2026.
Latest OPEXUS vulnerabilities
- 9.8 Critical severity
eComplaint: Direct Request
OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'. Users would see these unexpected files in cases. Uploading a large numb
- 9.8 Critical severity
eComplaint: Exposure of Sensitive Information to an Unauthorized Actor
OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password a
- 7.5 High severity
eComplaint: Authorization Bypass Through User-Controlled Key
OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files.
- 9.8 Critical severity
eCase Portal: Authorization Bypass Through User-Controlled Key
OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files.
- 7.6 High severity
eCASE Audit: Incorrect Authorization
OPEXUS eCASE Audit allows an authenticated attacker to modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disabled or blocked by an administrator. Fixed in eCASE Platform 11.14.1.0.
- 9.8 Critical severity
FOIAXpress Public Access Link (PAL): Improper Neutralization of Special Elements used in an SQL Command
OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database.
- 7.5 High severity
FOIAXpress Public Access Link (PAL): Improper Restriction of Excessive Authentication Attempts
OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers can more easily brute force passwords.