PatchTheCVECVE-2025-61997: OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within
CVE-2025-61997 is a medium-severity flaw (CVSS 4.3) affecting foiaxpress. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise Banner image upload field. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 85%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2025-10-08 |
| Last modified | 2026-10-08 |
Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-61997?
foiaxpress: upgrade to 11.13.3.0. Exact commands for each OS are on this page.
Is CVE-2025-61997 being exploited?
CVE-2025-61997 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-61997 affect?
CVE-2025-61997 affects foiaxpress. Severity is medium (CVSS 4.3). OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise Banner image upload field. Injected content is executed in the context of other users when they gener
How urgent is CVE-2025-61997?
Priority 19/100. No elevated risk signals yet.
Related CVEs
- CVE-2025-62586 CRITICAL 9.8 UPGRADE OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password
- CVE-2025-61996 MEDIUM 4.3 UPGRADE OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within
- CVE-2025-61998 MEDIUM 4.3 UPGRADE OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a UR
- CVE-2025-61999 MEDIUM 4.3 UPGRADE OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedde