A flaw in OPEXUS eComplaint and eCASE allows an authenticated user to insert malicious script fragments into their first or last name fields. When other users view the name, the attackers’ code executes in the victim’s browser, enabling the attacker to run scripts with the victim’s session privileges. This can lead to unauthorized data access, session hijacking, or additional malicious payloads.

The exploit applies to OPEXUS eComplaint and eCASE systems running versions older than 10.2.0.0 where name fields are rendered without proper sanitation. Any instance with unescaped first or last name display is affected.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score below 1 percent denotes a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack requires user authentication; an attacker updates their own profile, injects code, and later causes it to run when the profile is displayed to another user. Successful exploitation can compromise confidentiality, integrity, or authorization within the victim’s session.