PatchTheCVECVE-2025-61996: OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within
CVE-2025-61996 is a medium-severity flaw (CVSS 4.3) affecting foiaxpress. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 85%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2025-10-08 |
| Last modified | 2026-10-08 |
Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-61996?
foiaxpress: upgrade to 11.13.3.0. Exact commands for each OS are on this page.
Is CVE-2025-61996 being exploited?
CVE-2025-61996 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-61996 affect?
CVE-2025-61996 affects foiaxpress. Severity is medium (CVSS 4.3). OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. Injected content is executed in the context of other users when they generate an Annual Report. Succes
How urgent is CVE-2025-61996?
Priority 19/100. No elevated risk signals yet.
Related CVEs
- CVE-2025-62586 CRITICAL 9.8 UPGRADE OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password
- CVE-2025-61997 MEDIUM 4.3 UPGRADE OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within
- CVE-2025-61998 MEDIUM 4.3 UPGRADE OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a UR
- CVE-2025-61999 MEDIUM 4.3 UPGRADE OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedde