BroadLearning

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

BroadLearning records in CISA KEV

No BroadLearning vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Eclass Ip 3 records MEDIUM

Records

3 records

TI-2019-07264 CVE-2019-9885 · GHSA-xvj9-g93g-8ggp

eClass platform contains a SQL injection vulnerability

MEDIUM 47

eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02624 Published 2019-07-25 Fixed in 2.25.10.2.1 CWE-89

TI-2019-07263 CVE-2019-9884 · GHSA-v994-ggf7-gpj5

eClass platform contains a Broken Access Control vulnerability

MEDIUM 47

eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0296 Published 2019-07-25 Fixed in 2.25.10.2.1 CWE-284

TI-2019-07265 CVE-2019-9886 · GHSA-33jr-73hp-7wxc

eClass platform allows user to download arbitrary files without authentication

LOW 37

Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02245 Published 2019-07-11 Fixed in 2.25.10.2.1 CWE-22

Open these records in search →

Critical	2
High	1
Medium	0
Low	0
No CVSS	0