Authenticated users can embed JavaScript into the "Estimated Staff Hours" comment. When another user opens the Project Cost tab, the script runs in their browser context. The vulnerability permits the attacker to steal session cookies, deface the application, or execute arbitrary actions under the victim’s user identity, compromising confidentiality and possibly integrity of data.

The flaw affects OPEXUS eCASE Audit for any version released before 11.14.2.0. Users of the product must verify whether they are on a version earlier than the patched release.

The CVSS score of 4.8 indicates a moderate impact, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session and the ability to edit the comment field, after which the malicious code runs in the context of any other user who views the affected tab. The attack is local to the application and does not involve remote code execution or network bypasses.