CVE-2025-61998
Last modified
CVE-2025-61998 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager. Injected content is executed in the context of other users when they click the malicious link. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager. Injected content is executed in the context of other users when they click the malicious link. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Opexustech | Foiaxpress | < 11.13.3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-61998?
How severe is CVE-2025-61998?
How do I fix CVE-2025-61998?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-61987GroupSession Free edition prior to ver5.3.0, GroupSession by…6.9
- CVE-2025-6199A flaw was found in the GIF parser of GdkPixbuf’s LZW decode…3.3
- CVE-2025-61990When using a multi-bladed platform with more than one blade,…8.7
- CVE-2025-61994Cross-site scripting vulnerability exists in GROWI prior to …5.4
- CVE-2025-61996OPEXUS FOIAXpress before 11.13.3.0 allows an administrative …4.8
- CVE-2025-61997OPEXUS FOIAXpress before 11.13.3.0 allows an administrative …4.8
- CVE-2025-61999OPEXUS FOIAXpress before 11.13.3.0 allows an administrative …4.8
- CVE-2025-6200The GeoDirectory WordPress plugin before 2.8.120 does not v…5.9
- CVE-2025-62000BullWall Ransomware Containment may not always detect an enc…7.1
- CVE-2025-62001BullWall Ransomware Containment supports configurable file a…8.8
- CVE-2025-62002BullWall Ransomware Containment considers the number of file…8.1
- CVE-2025-62003BullWall Server Intrusion Protection has a noticeable config…7.7
Are you affected by CVE-2025-61998?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST