Corporate Training Management System
Monthly
Arbitrary command execution in SUNNET Corporate Training Management System through v10.3 allows authenticated administrators to upload a malicious ZIP archive via the e-paper draft upload function. Successful exploitation leads to full server compromise. No public exploit code or active exploitation is known, and EPSS indicates low exploitation probability.
Client-side security enforcement bypass in Gobito's Corporate Training Management System permits authenticated users to manipulate input data that the server accepts without independent validation. The root cause is CWE-602: security controls enforced only in the browser are trivially circumvented by crafting direct HTTP requests, bypassing form-level restrictions. No active exploitation has been identified, and CVSS places this at Medium (4.3), reflecting limited integrity impact constrained by the authentication prerequisite.
Arbitrary command execution in SUNNET Corporate Training Management System through v10.3 allows authenticated administrators to upload a malicious ZIP archive via the e-paper draft upload function. Successful exploitation leads to full server compromise. No public exploit code or active exploitation is known, and EPSS indicates low exploitation probability.
Client-side security enforcement bypass in Gobito's Corporate Training Management System permits authenticated users to manipulate input data that the server accepts without independent validation. The root cause is CWE-602: security controls enforced only in the browser are trivially circumvented by crafting direct HTTP requests, bypassing form-level restrictions. No active exploitation has been identified, and CVSS places this at Medium (4.3), reflecting limited integrity impact constrained by the authentication prerequisite.