CVE-2024-32405

The inducer relate web-based learning and teaching environment (versions prior to v.2024.1 ) is susceptible to a Reflective Cross-Site Scripting (XSS) vulnerability. A remote attacker can escalate privileges by sending a crafted payload to the Answer field of the InlineMultiQuestion parameter wit...

CVE-2024-32406

A Server-Side Template Injection (SSTI) vulnerability exists in inducer relate (and relate ) versions prior to v.2024.1 . The flaw is located within the Batch-Issue Exam Tickets function, where a remote attacker can execute arbitrary code by sending a crafted payload. Successful exploitation may ...

CVE-2024-32404

The inducer relate courseware package is vulnerable to a Server-Side Template Injection (SSTI) vulnerability in versions prior to v.2024.1 . This flaw allows remote attackers to execute arbitrary code by sending a crafted payload to the Markup Sandbox feature. To mitigate this risk, users are rec...

CVE-2024-32407

An issue in inducer (or Relate ) versions prior to v.2024.1 allows a remote attacker to execute arbitrary code by sending a crafted payload to the Page Sandbox feature. The vulnerability is also linked to a stored cross-site scripting (XSS) flaw in Relate. To resolve this issue, users are recomme...

CVE-2026-41588

RELATE is a web-based courseware package. CVE-2026-41588 describes a timing attack in the authentication path: in course/auth.py, function check_sign_in_key(), present prior to commit 2f68e16. The issue has been patched by that commit. CVSS 3.1 vector indicates network attack with high impact on ...