CVE-2020-26565

ObjectPlanet Opinio before 7.14 is vulnerable to an Expression Language Injection via the admin/permissionList.do parameter, allowing retrieval of potentially sensitive serverInfo data. The issue affects Opinio versions prior to 7.14; remediation is upgrading to 7.14 or later. PoCs and public wri...

CVE-2020-26564

ObjectPlanet Opinio is affected by XXE in versions before 7.15. The vulnerability arises from a sequence where an attacker modifies a CSS file to include an ENTITY, creates an XML that references that CSS, and imports the XML via the survey admin interface, enabling an XXE that can be triggered d...

CVE-2020-26806

ObjectPlanet Opinio is affected by CVE-2020-26806 in versions before 7.15. The vulnerability allows Unrestricted File Upload of executable JSP files via admin/file.do, enabling remote code execution because filePath can be traversed and fileContent can contain JSP. The issue is demonstrated as an...

CVE-2020-26563

ObjectPlanet Opinio before 7.14 is vulnerable to reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string, with stored XSS if inputs to survey/admin/*.do come from untrusted users. Affected versions are prior to 7.14; a fix/patch was provided by ObjectPlanet (referenc...

CVE-2023-4472

Objectplanet Opinio 7.22 and earlier are affected by a cryptographically weak PRNG with a predictable seed, enabling unauthenticated takeover of any user’s account. Root cause: weak PRNG in Opinio’s code path. Impact: high confidentiality, integrity, and availability risk via network attack; no u...