Medium severity4.3NVD Advisory· Published Oct 8, 2025· Updated Jun 17, 2026
CVE-2025-61997
CVE-2025-61997
Description
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise Banner image upload field. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<11.13.3.0+ 1 more
- (no CPE)range: <11.13.3.0
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
3- raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-280-01.jsonnvdThird Party Advisory
- www.cve.org/CVERecordnvdThird Party Advisory
- docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.3.0.pdfnvdRelease Notes
News mentions
0No linked articles in our index yet.