Opinio
Monthly
Stored cross-site scripting in ObjectPlanet Opinio 7.26 rev12562 allows a high-privileged attacker to inject persistent malicious JavaScript through the survey-import feature, which then executes in the browser of any user who subsequently views the compromised survey. The CVSS 4.0 vector confirms PR:H, meaning exploitation requires elevated application access (e.g., survey administrator or import-capable role), limiting the attack surface relative to unauthenticated XSS vulnerabilities. No active exploitation has been identified; EPSS sits at 0.04% (13th percentile), consistent with a niche, privilege-gated stored XSS in specialized survey software.
Blind Server-Side Request Forgery in ObjectPlanet Opinio 7.26 (rev12562) enables an authenticated high-privilege user to coerce the survey server into issuing outbound HTTP GET requests to arbitrary internal or external destinations via crafted survey-import payloads. Because the SSRF is blind, the attacker receives no response body, constraining practical impact to internal network probing and side-effect triggering on reachable internal endpoints. EPSS is 0.05% at the 15th percentile, no KEV listing exists, and no public exploit code has been identified.
Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication.
In ObjectPlanet Opinio before 7.6.4, there is XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in ObjectPlanet Opinio 7.26 rev12562 allows a high-privileged attacker to inject persistent malicious JavaScript through the survey-import feature, which then executes in the browser of any user who subsequently views the compromised survey. The CVSS 4.0 vector confirms PR:H, meaning exploitation requires elevated application access (e.g., survey administrator or import-capable role), limiting the attack surface relative to unauthenticated XSS vulnerabilities. No active exploitation has been identified; EPSS sits at 0.04% (13th percentile), consistent with a niche, privilege-gated stored XSS in specialized survey software.
Blind Server-Side Request Forgery in ObjectPlanet Opinio 7.26 (rev12562) enables an authenticated high-privilege user to coerce the survey server into issuing outbound HTTP GET requests to arbitrary internal or external destinations via crafted survey-import payloads. Because the SSRF is blind, the attacker receives no response body, constraining practical impact to internal network probing and side-effect triggering on reachable internal endpoints. EPSS is 0.05% at the 15th percentile, no KEV listing exists, and no public exploit code has been identified.
Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication.
In ObjectPlanet Opinio before 7.6.4, there is XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.