EUVD-2025-200215Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H reflects import privilege requirement; S:C and UI:R capture stored XSS executing in victim browsers; no availability impact.
Primary rating from Vendor (64c5ae8f-7972-4697-86a0-7ada793ac795).
CVSS VectorVendor: 64c5ae8f-7972-4697-86a0-7ada793ac795
Lifecycle Timeline
4DescriptionCVE.org
Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.
AnalysisAI
Stored cross-site scripting in ObjectPlanet Opinio 7.26 rev12562 allows a high-privileged attacker to inject persistent malicious JavaScript through the survey-import feature, which then executes in the browser of any user who subsequently views the compromised survey. The CVSS 4.0 vector confirms PR:H, meaning exploitation requires elevated application access (e.g., survey administrator or import-capable role), limiting the attack surface relative to unauthenticated XSS vulnerabilities. No active exploitation has been identified; EPSS sits at 0.04% (13th percentile), consistent with a niche, privilege-gated stored XSS in specialized survey software.
Technical ContextAI
ObjectPlanet Opinio is a Java-based web survey platform. The affected version is 7.26 rev12562 (CPE: cpe:2.3:a:objectplanet:opinio:7.26:*:*:*:*:*:*:*). CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied data introduced via the survey-import pathway is stored without adequate sanitization or output encoding, and is later rendered in victim browsers without escaping. The import feature likely parses survey definitions (XML, CSV, or proprietary format) and persists question text or metadata directly into the database; any JavaScript embedded in those fields survives storage and executes on rendering.
RemediationAI
Consult the ObjectPlanet Opinio changelog at https://www.objectplanet.com/opinio/changelog.html to identify whether a patched revision beyond rev12562 has been released - no specific fix version is confirmed in the available intelligence. If an upgrade is not immediately available, restrict access to the survey-import feature to the smallest possible set of trusted administrators, as exploitation requires high-privilege access to that function. Additionally, implement a Content Security Policy (CSP) header that disallows inline script execution to reduce the impact of any stored XSS payload reaching end-user browsers. Review existing imported surveys for unexpected script tags or event-handler attributes in question text or metadata fields.
Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to
In ObjectPlanet Opinio before 7.6.4, there is XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely expl
Blind Server-Side Request Forgery in ObjectPlanet Opinio 7.26 (rev12562) enables an authenticated high-privilege user to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today