CVE-2019-7684

The CVE-2019-7684 entry describes a vulnerability in inxedu (through 2018-12-24) where the file upload logic in VideoUploadController#gok4 (com/inxedu/os/common/controller/VideoUploadController.java) uses the /video/uploadvideo fileType parameter to control allowed extensions. An attacker can mod...

CVE-2019-7684

inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file. The vulnerable code location is com.inxedu.os.common.controller.VideoUploadControllergok4 com/inxedu/os/common/controller/VideoUploadController.java. The attacker uses the /video/uploadvideo fileTyp...

CVE-2019-7684: Unrestricted Upload of File with Dangerous Type

inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file. The vulnerable code location is com.inxedu.os.common.controller.VideoUploadControllergok4 com/inxedu/os/common/controller/VideoUploadController.java. The attacker uses the /video/uploadvideo fileTyp...

inxedu SQL Injection Vulnerability

inxedu is a set of open source online education platform of China's inxedu technology company. The platform includes an online school system, a live broadcasting system, an examination system, a community system and a marketing website. SQL injection vulnerability exists in inxedu 2018-12-24 and...

CVE-2019-3576

inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveorite/ PATHINFO. The vulnerable code location is com.inxedu.os.edu.controller.user.UserControllerdeleteFavorite aka deleteFavorite in...

Sql injection

inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveorite/ PATHINFO. The vulnerable code location is com.inxedu.os.edu.controller.user.UserControllerdeleteFavorite aka deleteFavorite in...

CVE-2019-3576

CVE-2019-3576 affects the inxedu platform through 2018-12-24, where a SQL injection vulnerability exists in the user flow—specifically in the deleteFavorite path handled by UserController (deleteFavorite in com/inxedu/os/edu/controller/user/UserController.java) and triggered via MyBatis in course...

CVE-2019-3576

inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveorite/ PATHINFO. The vulnerable code location is com.inxedu.os.edu.controller.user.UserControllerdeleteFavorite aka deleteFavorite in...

CVE-2019-3576: Improper Neutralization of Special Elements used in an SQL Command

inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveorite/ PATHINFO. The vulnerable code location is com.inxedu.os.edu.controller.user.UserControllerdeleteFavorite aka deleteFavorite in...

Arbitrary File Upload Vulnerability in inxedu Online Classroom

Incu open source online school system is developed by the Beijing Incu Times Technology Co., Ltd. launched the first Java version of the open source online school source code to build the system . inxedu online classroom there are arbitrary file upload vulnerability , the vulnerability arises...