MEDIUM🇬🇧 English

CVE-2025-13873

CVSS 4.8v4.0pub. 2025-12-02upd. 2025-12-04

Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.

oryginał EN

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Objectplanet Opinio
APP
Objectplanet
7.26

🔵

ZWERYFIKUJ U PRODUCENTA

Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.

Tagi

XSS

CWE

CWE-79

Referencje

www.objectplanet.com/opinio/changelog.html…

Powiązane podatności

CVE-2023-4472CRITICAL9.8PL ✓ten sam produkt

Objectplanet Opinio — przejęcie konta przez słaby PRNG z przewidywalnym ziarnem

CVE-2020-26565HIGH7.5ten sam produkt

ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from para...

CVE-2020-26806HIGH8.8ten sam produkt

admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resu...

CVE-2020-26564MEDIUM6.5ten sam produkt

ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY conten...

CVE-2020-26563MEDIUM6.1ten sam produkt

ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmi...