medium6.1
CVE-2020-26563
ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string.
Impact
ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored XSS if input to survey/admin/*.do is accepted from untrusted users.)
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Objectplanet | Opinio | before 7.13 |
Weakness classification
References
- NVD record
- CVE.org record
- https://packetstormsecurity.com/files/163699/ObjectPlanet-Opinio-7.12-Cross-Site-Scripting.html
- https://www.objectplanet.com/opinio/changelog.html
- https://packetstormsecurity.com/files/163699/ObjectPlanet-Opinio-7.12-Cross-Site-Scripting.html
- https://www.objectplanet.com/opinio/changelog.html