VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026

CVE-2026-32865

CVE-2026-32865

Description

OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing security questions are not asked during the process.

Affected products

5
  • Opexustech/Ecase Ecomplaint
    cpe:2.3:a:opexustech:ecase_ecomplaint:*:*:*:*:*:*:*:*
    Range: <10.1.0.0
  • Opexus/eComplaintllm-fuzzy2 versions
    <10.1.0.0+ 1 more
    • (no CPE)range: <10.1.0.0
    • (no CPE)range: 0
  • Opexus/eCASEllm-fuzzy2 versions
    <10.1.0.0+ 1 more
    • (no CPE)range: <10.1.0.0
    • (no CPE)range: 0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.