CVE-2026-22232

OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is executed whenever another user views the project. Fixed in OPEXUS eCASE Audit 11.14.2.0.

Score

CVSS 3.1 5.5 Medium

Status

Analyzed - 9119a7d8-5eab-497f-8521-727c672e3725

Published

2026-01-08

Last modified

2026-01-08

Weaknesses

CWE-79

Affected products

• Ecase Audit (Opexus)
• Ecase Audit (Opexustech)

References

• https://docs.opexustech.com/docs/oig/audit/eCase_Audit_Release_Notes_11.14.2.0.pdf
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-01.json
• https://www.cve.org/CVERecord?id=CVE-2026-22232