Opexustech vulnerabilities
We track 5 vulnerabilities in Opexustech products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on March 19, 2026.
Latest Opexustech vulnerabilities
- 9.8 Critical severity
eComplaint: Direct Request
OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'. Users would see these unexpected files in cases. Uploading a large numb
- 9.8 Critical severity
eComplaint: Exposure of Sensitive Information to an Unauthorized Actor
OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password a
- 7.5 High severity
eComplaint: Authorization Bypass Through User-Controlled Key
OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files.
- 9.8 Critical severity
FOIAXpress Public Access Link (PAL): Improper Neutralization of Special Elements used in an SQL Command
OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database.
- 7.5 High severity
FOIAXpress Public Access Link (PAL): Improper Restriction of Excessive Authentication Attempts
OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers can more easily brute force passwords.