CVE-2024-13267: Improper Neutralization of Directives in Statically Saved Code

Improper Neutralization of Directives in Statically Saved Code 'Static Code Injection' vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in the Drupal Opigno module prior to version 3.1.2, which stems from an unsuccessful neutralization of directives in statically saved code, resulting in a stat...

CVE-2024-13264: Improper Neutralization of Directives in Statically Saved Code

Improper Neutralization of Directives in Statically Saved Code 'Static Code Injection' vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2...

CVE-2024-13263: Improper Neutralization of Directives in Statically Saved Code

Improper Neutralization of Directives in Statically Saved Code 'Static Code Injection' vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1...

Drupal Opigno TinCan Question Type module < 7.x-1.3 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by Juraj Nemec in WordPress Module Opigno TinCan Question Type versions 7.x-1.3...

Drupal Opigno module < 7.x-1.23 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by Yurii Boichenko in WordPress Module Opigno versions 7.x-1.23...

Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031

The Opigno TinCan Question Type module is related to Opigno LMS distribution. The module adds a new question type for the Quiz module. With this new question type, you will be able to import TinCan Packages to your Drupal instance and to use it as a question. Uploaded files were not sufficiently...

PT-2024-10093

Name of the Vulnerable Software and Affected Versions Drupal Opigno versions 7.X-1.0 through 7.X-1.23 Description The issue is related to improper neutralization of directives in statically saved code, also known as 'Static Code Injection', which allows PHP Local File Inclusion. This can be...

Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032

The Opigno module is related to Opigno LMS distribution. Opigno Scorm submodule exposes an API for extracting and handling SCORM packages. Uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution RCE and/or Cross Site Scripting XS...

DRUPAL-CONTRIB-2024-029

The Opigno Learning Path module enables you to manage group content. Administrative forms allow uploading malicious files which may contain arbitrary code RCE or cross site scriptiong XSS. These forms were not adequately controlled with permissions that communicate the severity of the permission...

DRUPAL-CONTRIB-2024-028

The Opigno module is related to Opigno LMS distribution. It implements the module entity, that is a sub-part of a training. In the opigno\module module, uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution RCE and/or Cross Sit...

DRUPAL-CONTRIB-2024-027

The Opigno group manager project is related to Opigno LMS distribution. It allows to build the contents of learning paths, by combining together modules, courses, and other activities, ordering them, and defining conditional rules for the transitions from one step to the next one. An administrati...

Drupal Opigno Learning path module < 3.1.2 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by Marcin Grabias in WordPress Module Opigno Learning path versions 3.1.2...

Drupal Opigno module module < 3.1.2 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by Marcin Grabias in WordPress Module Opigno module versions 3.1.2...

Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029

The Opigno Learning Path module enables you to manage group content. Administrative forms allow uploading malicious files which may contain arbitrary code RCE or cross site scriptiong XSS. These forms were not adequately controlled with permissions that communicate the severity of the permission...

Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027

The Opigno group manager project is related to Opigno LMS distribution. It allows to build the contents of learning paths, by combining together modules, courses, and other activities, ordering them, and defining conditional rules for the transitions from one step to the next one. An administrati...

PT-2024-10350

Name of the Vulnerable Software and Affected Versions Opigno Learning path versions 0.0.0 through 3.1.2 Description The issue is related to improper neutralization of directives in statically saved code, also known as 'static code injection', which allows for PHP Local File Inclusion. This can...

Drupal Opigno group manager module < 3.1.1 - Administrator+ Remote Code Execution (RCE) vulnerability

Administrator+ Remote Code Execution RCE vulnerability discovered by catch in WordPress Module Opigno group manager versions 3.1.1...

PT-2025-2085

Name of the Vulnerable Software and Affected Versions Opigno group manager versions 0.0.0 through 3.1.1 Description The issue is related to the improper neutralization of directives in statically saved code, also known as 'static code injection', which allows for PHP Local File Inclusion in the...

Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028

The Opigno module is related to Opigno LMS distribution. It implements the module entity, that is a sub-part of a training. In the opignomodule module, uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution RCE and/or Cross Site...