Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the...
9.8CVSS
7.2AI Score
0.001EPSS
ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to...
6.5CVSS
6.9AI Score
0.001EPSS
ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo...
7.5CVSS
7.6AI Score
0.005EPSS
admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP...
8.8CVSS
8.9AI Score
0.004EPSS
ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored XSS if input to survey/admin/*.do is accepted from untrusted...
6.1CVSS
5.5AI Score
0.003EPSS
6.1CVSS
6.8AI Score
0.001EPSS