CVE-2026-22233 MEDIUM

CVE-2026-22233: OPEXUS eCASE Audit Project Cost stored XSS

Vendor Opexus
Product eCASE Audit
Weakness CWE-79 · XSS
Published January 8, 2026
Last update January 8, 2026
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment in the "Estimated Staff Hours" field. The JavaScript is executed whenever another user visits the Project Cost tab. Fixed in OPEXUS eCASE Audit 11.14.2.0.

Key dates

02Disclosure timeline

January 8, 2026 CVE published
January 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-8921 Zita Elementor Site Library <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVE-2024-37888 The Open Link CKEditor plugin has a cross-site scripting (XSS) vulnerability in open link functionality CVE-2023-3683 LivelyWorks Articart search cross site scripting CVE-2025-30898 WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability CVE-2024-5152 ElementsReady Addons for Elementor <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting