Priority HIGH 82
An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via uploading a crafted jsp file.
Inxedu
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Inxedu records in CISA KEVNo Inxedu vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records in Inxedu · all components
TI-2020-17940 CVE-2020-35326 · GHSA-fqx2-wm63-7f5w
SQL Injection vulnerability in file…
Priority HIGH 82
SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0.6 via the id value.
TI-2020-14008 CVE-2020-21152 · GHSA-p9pv-g558-xj48
SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary…
Priority HIGH 82
SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunction.
TI-2024-23190 CVE-2024-35080
An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows…
Priority MEDIUM 50
An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
TI-2024-23189 CVE-2024-35079
An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows…
Priority MEDIUM 50
An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
TI-2019-05417 CVE-2019-7684 · GHSA-79jh-75vh-fqv7
inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious…
Priority MEDIUM 46
inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file.
TI-2020-17973 CVE-2020-35430 · GHSA-vc5f-m77q-499m
SQL Injection in com/inxedu/OS/edu/controller/letter/AdminMsgSystemController in Inxedu…
Priority MEDIUM 44
SQL Injection in com/inxedu/OS/edu/controller/letter/AdminMsgSystemController in Inxedu v2.0.6 via the ids parameter to admin/letter/delsystem.