Medium severity5.5NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026

CVE-2026-32868

Description

OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the 'My Information' screen. An authenticated attacker can inject parts of an XSS payload in the first and last name fields. The payload is executed when the full name is rendered. The attacker can run script in the context of a victim's session.

Affected products

Opexustech/Ecase Ecomplaint
cpe:2.3:a:opexustech:ecase_ecomplaint:*:*:*:*:*:*:*:*
Range: <10.2.0.0
Opexus/eComplaintllm-fuzzy2 versions
<10.2.0.0+ 1 more
- (no CPE)range: <10.2.0.0
- (no CPE)range: 0
Opexus/eCASEllm-fuzzy2 versions
<10.2.0.0+ 1 more
- (no CPE)range: <10.2.0.0
- (no CPE)range: 0

Patches

Vulnerability mechanics

References

www.cve.org/CVERecordnvdThird Party Advisory
raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.jsonnvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000