CVE-2025-54832

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of states and territories.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-472

Affected software

VendorProductVersions
OPEXUSFOIAXpress Public Access Link (PAL)>= 11.1.0, < 11.12.3.0

References

Timeline

Published
Jul 31, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-548337.5OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. UnauthenticatCVE-2025-548345.3OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx eCVE-2025-548386.5An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a sharedCVE-2025-54848.3A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is CVE-2025-548487.5A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A speCVE-2025-548497.5A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A speCVE-2025-54858.6User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 1CVE-2025-548507.5A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A speCVE-2025-548517.5A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A speCVE-2025-548526.1A reflected cross-site scripting (xss) vulnerability exists in the modifyAeTitle functionality of MedDream PACS Premium 7.3.6.870. A specialCVE-2025-548535.4A reflected cross-site scripting (xss) vulnerability exists in the modifyUser functionality of MedDream PACS Premium 7.3.6.870. A specially CVE-2025-548547.5When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause
CVE-2025-54832: Medium severity, CVSS 4.3 | Vulnix