HIGH🇵🇱 Wersja polska

CVE-2020-26806

CVSS 8.8v3.1pub. 2021-07-31upd. 2024-11-21

admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Objectplanet Opinio

    APP
    Objectplanet
    < 7.15
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEPath Traversal
CWE
References

Related vulnerabilities

CVE-2023-4472CRITICAL9.8PL ✓same product

Objectplanet Opinio — przejęcie konta przez słaby PRNG z przewidywalnym ziarnem

CVE-2020-26565HIGH7.5same product

ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from para...

CVE-2025-13873MEDIUM4.8same product

Stored XSS w funkcji survey-import ObjectPlanet Opinio 7.26 rev12562 pozwala atakującemu na wstrzyknięcie dowo...

CVE-2020-26564MEDIUM6.5same product

ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY conten...

CVE-2020-26563MEDIUM6.1same product

ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmi...