CVE-2026-32867CWE-425CWE-639

OPEXUS eComplaint unauthenticated file upload

Medium · published March 19, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'. Users would see these unexpected files in cases. Uploading a large number of files could consume storage.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00363 · 29.0th percentile
Weaknesses
CWE-425 · Direct Request ('Forced Browsing'); CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-19T15:48Z
EPSS history
Timeline
  • 19 MAR 15:48Z
    OPEXUS eComplaint unauthenticated file upload
    cvelistv5