Vulnerability · Published Jul 31, 2025 · Assigned by cisa-cg
CVE-2025-54833OPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypass
Medium 5.3
In plain English
A medium-severity security flaw in FOIAXpress Public Access Link (PAL) from OPEXUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 50.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers can more easily brute force passwords.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OPEXUS | FOIAXpress Public Access Link (PAL) | 11.1.0 – before 11.12.3.0 |
Weakness: CWE-307, CWE-602 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N