PatchTheCVECVE-2025-61998: OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a UR
CVE-2025-61998 is a medium-severity flaw (CVSS 4.3) affecting foiaxpress. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager. Injected content is executed in the context of other users when they click the malicious link. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 85%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2025-10-08 |
| Last modified | 2026-10-08 |
Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-61998?
foiaxpress: upgrade to 11.13.3.0. Exact commands for each OS are on this page.
Is CVE-2025-61998 being exploited?
CVE-2025-61998 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-61998 affect?
CVE-2025-61998 affects foiaxpress. Severity is medium (CVSS 4.3). OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager. Injected content is executed in the context of other users when they click the m
How urgent is CVE-2025-61998?
Priority 19/100. No elevated risk signals yet.
Related CVEs
- CVE-2025-62586 CRITICAL 9.8 UPGRADE OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password
- CVE-2025-61996 MEDIUM 4.3 UPGRADE OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within
- CVE-2025-61997 MEDIUM 4.3 UPGRADE OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within
- CVE-2025-61999 MEDIUM 4.3 UPGRADE OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedde