CVE-2025-54832
CVE-2025-54832 is a medium-severity vulnerability in Opexustech Foiaxpress Public Access Link with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-472.
Key facts
- Severity: Medium (CVSS 3.x base score 4.3)
- CVSS v4: 5.3
- EPSS exploit prediction: 0% (24th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-23293
- Weakness: CWE-472
- Affected product: Opexustech Foiaxpress Public Access Link
- Published:
- Last modified:
Description
OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of states and territories.
Frequently asked questions
- What is CVE-2025-54832?
- OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of states and territories.
- How severe is CVE-2025-54832?
- CVE-2025-54832 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
- Is CVE-2025-54832 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-54832?
- CVE-2025-54832 affects Opexustech Foiaxpress Public Access Link. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-54832?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-54832 have an EU (EUVD) identifier?
- Yes. CVE-2025-54832 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-23293.
- When was CVE-2025-54832 published?
- CVE-2025-54832 was published on 2025-07-31 and last updated on 2026-06-17.
References
- https://docs.opexustech.com/docs/foiaxpress/11.12.0/FOIAXpress_Release_notes_11.12.3.0.pdf
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-174-01.json
- https://www.cve.org/CVERecord?id=CVE-2025-54832
Affected products (1)
- cpe:2.3:a:opexustech:foiaxpress_public_access_link:*:*:*:*:*:*:*:*
More vulnerabilities in Opexustech Foiaxpress Public Access Link
- CVE-2025-58462 — Critical (CVSS 9.8): OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A…
- CVE-2024-53553 — Critical (CVSS 9.1): An issue in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 allows attackers to bypass authentication via crafted web…
- CVE-2025-54834 — Medium (CVSS 5.3): OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the…
- CVE-2025-54833 — Medium (CVSS 5.3): OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA…
All CVEs affecting Opexustech Foiaxpress Public Access Link →
Other CWE-472 vulnerabilities
- CVE-2025-43933 — Critical (CVSS 9.8): fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and…
- CVE-2025-43930 — Critical (CVSS 9.8): Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a…
- CVE-2021-1295 — Critical (CVSS 9.8): Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P,…
- CVE-2021-1294 — Critical (CVSS 9.8): Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P,…
- CVE-2021-1293 — Critical (CVSS 9.8): Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P,…
- CVE-2021-1292 — Critical (CVSS 9.8): Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P,…