Beakon
Monthly
Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commands with Administrator rights. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected XSS in Beakon Learning Management System SCORM v5.4.3 allows an authenticated remote attacker to inject arbitrary JavaScript into a victim's browser session via the unsanitized `url` parameter of the SCORM loader endpoint. The PoC published on PacketStorm demonstrates direct cookie theft using a `javascript:alert(document.cookie)` payload, confirming the vulnerability is exploitable without specialized tooling. No patch has been identified at time of analysis; no public exploit identified at time of analysis beyond the published PoC, and EPSS at 0.25% (17th percentile) reflects low observed exploitation activity consistent with a niche product.
A SQL injection vulnerability (CVSS 9.8) that allows a remote attacker. Risk factors: public PoC available.
Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commands with Administrator rights. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected XSS in Beakon Learning Management System SCORM v5.4.3 allows an authenticated remote attacker to inject arbitrary JavaScript into a victim's browser session via the unsanitized `url` parameter of the SCORM loader endpoint. The PoC published on PacketStorm demonstrates direct cookie theft using a `javascript:alert(document.cookie)` payload, confirming the vulnerability is exploitable without specialized tooling. No patch has been identified at time of analysis; no public exploit identified at time of analysis beyond the published PoC, and EPSS at 0.25% (17th percentile) reflects low observed exploitation activity consistent with a niche product.
A SQL injection vulnerability (CVSS 9.8) that allows a remote attacker. Risk factors: public PoC available.