CVE-2026-32868
Published: Mar 19, 2026
Modified: Mar 19, 2026
CVSS v3.1
5.5
Description
OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the 'My Information' screen. An authenticated attacker can inject parts of an XSS payload in the first and last name fields. The payload is executed when the full name is rendered. The attacker can run script in the context of a victim's session.
| Vendor | Product | Versions |
|---|---|---|
OPEXUS | eComplaint | affected 0 - < 10.2.0.0unaffected 10.2.0.0 |
OPEXUS | eCASE | affected 0 - < 10.2.0.0unaffected 10.2.0.0 |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now