Medium severity4.3NVD Advisory· Published Oct 8, 2025· Updated Jun 17, 2026
CVE-2025-61998
CVE-2025-61998
Description
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager. Injected content is executed in the context of other users when they click the malicious link. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<11.13.3.0+ 1 more
- (no CPE)range: <11.13.3.0
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
3- raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-280-01.jsonnvdThird Party Advisory
- www.cve.org/CVERecordnvdThird Party Advisory
- docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.3.0.pdfnvdRelease Notes
News mentions
0No linked articles in our index yet.