CVE-2019-15747

CVE-2019-15747 affects SITOS six Build v6.2.1. A user with the Seminar Coordinator role can escalate to System Administrator due to insufficient server-side access checks, enabling privilege escalation. CVSS data in the records shows a high impact (CVSS‑3.1 base score 8.8) but no exploit details ...

CVE-2019-15749

CVE-2019-15749 affects SITOS six Build v6.2.1. The flaw allows a user to change their password and recovery email address without confirming the change with the old password, enabling an attacker who has access to the victim’s account (e.g., via XSS or an unattended workstation) to modify credent...

CVE-2019-15750

The CVE-2019-15750 entry is supported by multiple connected records that confirm a Cross-Site Scripting (XSS) vulnerability in SITOS six Build v6.2.1. The weakness is in the blog feature, where an attacker can supply a crafted id parameter to inject arbitrary web script or HTML. Impact is describ...

CVE-2019-15751

CVE-2019-15751 describes an unrestricted file upload in SITOS six Build v6.2.1. The vulnerability allows an unauthenticated attacker to upload a SCORM file with an executable extension to the web root, enabling remote code execution (e.g., PHP code to run OS commands). The CVE entry is supported ...

CVE-2019-15746

The CVE-2019-15746 entry concerns SITOS six Build v6.2.1, where an injection vulnerability allows an attacker to inject arbitrary PHP commands. The core issue described in connected sources is a lack of proper validation of user input, enabling execution of commands on the server within the web u...

CVE-2019-15748

SITOS six Build v6.2.1 is affected by CVE-2019-15748: unauthenticated upload/import of a SCORM 2004 package can lead to execution of arbitrary PHP code via a malicious package. Affected component: SITOS six Build (v6.2.1). Root cause implied by reports is insecure handling of uploaded SCORM conte...