CVE-2019-9884

CVE-2019-9884 affects the eClass platform (version

CVE-2019-9885

CVE-2019-9885 affects eClass platform prior to ip.2.5.10.2.1. The vulnerability is a SQL injection in the /admin/academic/studenview_left.php?StudentID parameter, caused by insufficient input validation in the web application. Exploitation would allow an attacker to execute arbitrary SQL commands...

CVE-2019-9886

CVE-2019-9886 affects BroadLearning eClass up to version ip.2.5.10.2.1, where arbitrary files can be downloaded without authentication via URLs containing download_attachment.php under templates or home folders. Root cause/impact: unauthenticated access to sensitive files (no login required). Pub...