CVE-2022-45892

Planet eStream (Planet Enterprises Ltd) prior to version 6.72.10.07 contains multiple stored XSS vulnerabilities across components such as Disclaimer, Search Function, Comments, Batch editing, Content Creation, Related Media, Create new user, and Change Username. Root cause is multiple stored XSS...

CVE-2022-45889

Planet eStream

CVE-2022-45896

Planet eStream (Planet Enterprises) prior to version 6.72.10.07 is vulnerable to an unauthenticated file upload issue via Upload2.ashx or Ajax.asmx/ProcessUpload2 (e.g., Choose a Video / Related Media or Upload Document), which can lead to remote code execution. The affected product/version is Pl...

CVE-2022-45894

Planet eStream (Planet Enterprises) before version 6.72.10.07 is affected by CVE-2022-45894 due to a directory traversal vulnerability in GetFile.aspx that allows reading arbitrary local files. The root cause is improper path handling enabling traversal via ..\ sequences. Impact is read access to...

CVE-2022-45893

Planet eStream (versions prior to 6.72.10.07) has a cookie-based authentication flaw in the ON cookie that can be exploited by a low-privilege user to access administrative and high-privilege accounts. A brute-force attack can compute a value enabling permanent access, effectively compromising co...

CVE-2022-45895

Planet eStream exposes sensitive information in versions prior to 6.72.10.07 due to issues involving the ON cookie (findable in Default.aspx HTML source) and the WhoAmI endpoint (path disclosure). The CVE-2022-45895 entry consolidates this information as a user-notification-style vulnerability wi...

CVE-2022-45890

Planet eStream (Planet Enterprises Ltd) before version 6.72.10.07 is vulnerable to a Reflected Cross-Site Scripting (XSS) issue via any metadata filter field (e.g., Default.aspx with the r or fo parameter). Root cause: unfiltered/unescaped user input reflected by the application. Impact: potentia...

CVE-2022-45891

Planet eStream prior to version 6.72.10.07 contains critical vulnerabilities that allow an attacker to call restricted functions, perform unauthenticated uploads via Upload2.ashx, and access content uploaded by other users (View.aspx after Ajax.asmx/SaveGrantAccessList). The CVE entry cites unaut...