Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile. An authenticated attacker can inject parts of an XSS payload in their first and last name fields. The payload is executed when the user's full name is rendered. The attacker can run script in the context of a victim's session.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-19 | 2 | Disclosure2 |
| 2026-03-23 | 1 | Disclosure1 |
CVE-2026-32866 OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile. An authenticated attacker can inje… https://www.cve.org/CVERecord?id=CVE-2026-32866
Post summary
A new CVE describes unsanitized name fields in OPEXUS eComplaint and eCASE that allow injection for authenticated users.
CVE-2026-32866 Stored XSS Vulnerability in OPEXUS eComplaint and eCASE Before 10.2.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32866
Post summary
A stored XSS vulnerability (CVE-2026-32866) targets OPEXUS eComplaint and eCASE in versions before 10.2.0.0, and upgrading to 10.2.0.0 or later resolves the issue.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-32866 - OPEXUS eComplaint and eCase stored XSS via profile first and last name Intel Report: https://ift.tt/4bTK9pt
Post summary
The alert identifies CVE-2026-32866 as a stored XSS vulnerability in OPEXUS eComplaint and eCase, with a reference to an Intel Report.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | opexustech | ecase_ecomplaint | - | - | - |