ObjectPlanet Opinio vulnerabilities

Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.

Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.

A Cross-Site Request Forgery (CSRF) vulnerability in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows uploading files on behalf of connected users and then accessing those files without authentication.