CVE-2025-58462

OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database.

CVSS 4.0

9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-25)

CWE

CWE-89

Published

2025-09-09

Modified

2026-09-30

Record from

the NVD, synced 2026-10-19

Affected

• opexustech:foiaxpress_public_access_link

References

• https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.1.0.pdf
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/IT/white/2025/va-25-252-01.json
• https://www.cve.org/CVERecord?id=CVE-2025-58462

Check your stackJSON