OPEXUS eCASE Audit allows an authenticated attacker to store malicious JavaScript in the 'A or SIC Number' field within the Project Setup functionality. When another user later views that project, the stored script executes in their browser. This flaw is a stored Cross‑Site Scripting vulnerability (CWE‑79).

The vulnerability affects OPEXUS eCASE Audit deployments running any version earlier than 11.14.2.0. All users of the affected versions are susceptible until the product is upgraded.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. The flaw requires authentication and internal access to the Project Setup interface, making it most relevant to insiders or compromised accounts. Because it is not listed in the CISA KEV catalog, it is not currently a known widely exploited vulnerability.