FOIAXpress Public Access Link (PAL) vulnerabilities

2 known vulnerabilities in FOIAXpress Public Access Link (PAL) from OPEXUS. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  FOIAXpress Public Access Link (PAL): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-58462Sep 9, 2025OPEXUS

  OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database.

• 7.5 High severity

  FOIAXpress Public Access Link (PAL): Improper Restriction of Excessive Authentication Attempts

  CVE-2025-54833Jul 31, 2025OPEXUS

  OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers can more easily brute force passwords.