Survey
Monthly
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Survey plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in administrative settings due to insufficient input sanitization and output escaping, affecting all versions up to and including 1.1. Authenticated attackers with administrator-level permissions can inject arbitrary JavaScript code that executes when users access affected pages, though this is restricted to multi-site installations or those with unfiltered_html disabled. With a CVSS score of 4.4 and high attack complexity requiring administrator privileges, the real-world risk is moderate; no public exploit code or KEV status has been indicated, making this a lower-priority remediation compared to critical vulnerabilities.
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Survey plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in administrative settings due to insufficient input sanitization and output escaping, affecting all versions up to and including 1.1. Authenticated attackers with administrator-level permissions can inject arbitrary JavaScript code that executes when users access affected pages, though this is restricted to multi-site installations or those with unfiltered_html disabled. With a CVSS score of 4.4 and high attack complexity requiring administrator privileges, the real-world risk is moderate; no public exploit code or KEV status has been indicated, making this a lower-priority remediation compared to critical vulnerabilities.
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.