An XSS vulnerability exists in OPEXUS eComplaint and eCASE when an attacker supplies a malicious payload in the "Name of Organization" field of case information. Because the input is not sanitized, the payload runs in the victim’s browser context whenever the case page is viewed. The attacker can hijack the victim’s session, steal credentials, or inject further malicious actions. This weakness is categorized as an input validation flaw (CWE‑79).

The flaw is present in versions of OPEXUS eComplaint and eCASE older than 10.2.0.0. All installations of these products that do not apply the 10.2.0.0 or newer release are susceptible.

The CVSS score of 5.1 indicates medium impact, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated and have permissions to create or edit case information to inject the payload. Once the payload is entered, any user who views the case page will have the code executed in their session context, potentially leading to credential theft or further attacks.