The vulnerability allows an authenticated attacker to embed JavaScript code in a comment when checking out a document. The script is executed every time another user opens the action history log, giving the attacker potential access to the victim’s session, cookies or other sensitive data on the client side. The weakness is a classic stored cross‑site scripting flaw and is listed as CWE‑79.

All installations of OPEXUS eCASE Audit Platform with versions older than 11.14.1.0 are affected. The issue exists in the Document Check Out functionality available to any authenticated user in the platform.

With a CVSS score of 4.8 the vulnerability is of moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers would need a valid authenticated session to inject the payload, so the attack vector is any authenticated user. Nonetheless, the risk of a successful XSS attack remains if attackers gain legitimate access or target a low‑privilege user with elevated trust.