First and last name fields on the My Information screen are not sanitized in OPEXUS eComplaint and eCASE products before 10.2.0.0. An attacker who can authenticate into the system can inject portions of an XSS payload into those fields. When the full name is later rendered for a victim, the malicious script runs in the victim’s browser session, allowing the attacker to execute arbitrary code within the context of that user. This enables theft of session cookies, credential hijacking, or other client‑side manipulation. The weakness aligns with standard reflected XSS vulnerabilities. The impact is primarily to confidentiality and integrity of the victim’s session data; availability is not directly affected.

Affected products are OPEXUS eCASE and OPEXUS eComplaint. Version releases prior to 10.2.0.0 contain the flaw. Users of any older release should verify the exact build against the version criteria.

The CVSS score of 5.1 indicates moderate severity. The EPSS probability is below 1 %, suggesting that exploitation is unlikely in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated user with access to the My Information screen; once logged in, the attacker can construct the payload. The lack of a public exploitation report and the low EPSS reduce the immediate risk but do not eliminate the need for remediation.