objectplanet opinio vulnerabilities

Latest objectplanet opinio CVEs

Newest publication first

1. CVE-2025-13873 The feature to import a survey is prone to stored Cross-Site Script attacks

   Published 2025-12-02

   Medium·CVSS 4.8 EPSS 0.22%

   Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.

2. CVE-2025-13872 Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio

   Published 2025-12-02

   Low·CVSS 2.1 EPSS 0.33%

   Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.

3. CVE-2025-13871 The feature to manage resources is prone to Cross-Site Request Forgery attacks

   Published 2025-12-02

   Low·CVSS 2.3 EPSS 0.19%

   Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication.

4. CVE-2023-4472 Cryptographically weak PRNG in Opinio 7.22

   Published 2024-02-01

   Critical·CVSS 9.8 EPSS 0.74%

   Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.

5. CVE-2020-26565 ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.

   Published 2021-07-31

   High·CVSS 7.5 EPSS 1.7%

   ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.

6. CVE-2020-26564 ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey template (containing a link to this .css file),...

   Published 2021-07-31

   Medium·CVSS 6.5 EPSS 1.1%

   ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey template (containing a link to this .css file), and import this .xml file at the survey/admin/folderSurvey.do?action=viewImport...

7. CVE-2020-26806 admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileCont...

   Published 2021-07-31

   High·CVSS 8.8 EPSS 6.0%

   admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code.

8. CVE-2020-26563 ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored XSS if input to survey/admin/*.do is accepted from u...

   Published 2021-07-30

   Medium·CVSS 6.1 EPSS 0.98%

   ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored XSS if input to survey/admin/*.do is accepted from untrusted users.)

9. CVE-2017-10798 In ObjectPlanet Opinio before 7.6.4, there is XSS.

   Published 2017-07-03

   Medium·CVSS 6.1 EPSS 0.64%

   In ObjectPlanet Opinio before 7.6.4, there is XSS.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.