CVE-2025-61999
Last modified
CVE-2025-61999 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedded in an SVG image used as a logo. Injected content is executed in the context of other users when they view affected pages. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedded in an SVG image used as a logo. Injected content is executed in the context of other users when they view affected pages. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Opexustech | Foiaxpress | < 11.13.3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-61999?
How severe is CVE-2025-61999?
How do I fix CVE-2025-61999?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-6199A flaw was found in the GIF parser of GdkPixbuf’s LZW decode…3.3
- CVE-2025-61990When using a multi-bladed platform with more than one blade,…8.7
- CVE-2025-61994Cross-site scripting vulnerability exists in GROWI prior to …5.4
- CVE-2025-61996OPEXUS FOIAXpress before 11.13.3.0 allows an administrative …4.8
- CVE-2025-61997OPEXUS FOIAXpress before 11.13.3.0 allows an administrative …4.8
- CVE-2025-61998OPEXUS FOIAXpress before 11.13.3.0 allows an administrative …4.8
- CVE-2025-6200The GeoDirectory WordPress plugin before 2.8.120 does not v…5.9
- CVE-2025-62000BullWall Ransomware Containment may not always detect an enc…7.1
- CVE-2025-62001BullWall Ransomware Containment supports configurable file a…8.8
- CVE-2025-62002BullWall Ransomware Containment considers the number of file…8.1
- CVE-2025-62003BullWall Server Intrusion Protection has a noticeable config…7.7
- CVE-2025-62004BullWall Server Intrusion Protection (SIP) services are init…7.7
Are you affected by CVE-2025-61999?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST