{"vulnerability": "CVE-2020-2656", "sightings": [{"uuid": "8ec37abc-3ba2-4e11-9bee-b40452fd1551", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2020-26560", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "08c21dc1-a429-4614-a4d6-488cff52194b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26562", "type": "published-proof-of-concept", "source": "https://t.me/avdno/856", "content": "\u0420\u0430\u0437\u0431\u043e\u0440 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Cybereason EDR, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0445 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 Denial of Service. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 EDR \u0441\u0435\u043d\u0441\u043e\u0440 \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u0435\u0442 \"\u0432\u0438\u0434\u0435\u0442\u044c\" \u0441\u043e\u0431\u044b\u0442\u0438\u044f, \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435: https://airbus-cyber-security.com/a-case-study-with-cybereason-edr-cve-2020-26562-cve-2020-26871/", "creation_timestamp": "2020-10-22T12:44:21.000000Z"}, {"uuid": "a817f526-c340-4384-8044-0673037e1f22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26565", "type": "seen", "source": "https://t.me/cibsecurity/26645", "content": "\u203c CVE-2020-26565 \u203c\n\nObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-31T20:25:50.000000Z"}, {"uuid": "9007f9a1-647a-4cc2-91a6-6c530557fb9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26564", "type": "seen", "source": "https://t.me/cibsecurity/26644", "content": "\u203c CVE-2020-26564 \u203c\n\nObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have ", "creation_timestamp": "2021-07-31T20:25:49.000000Z"}, {"uuid": "b164336f-c1fb-43a6-b054-fee2eed10bc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26569", "type": "seen", "source": "https://t.me/cibsecurity/21356", "content": "\u203c CVE-2020-26569 \u203c\n\nIn EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result packets can be incorrectly forwarded across VLAN boundaries. This can result in traffic being discarded on the receiving VLAN. This affects versions: 4.21.12M and below releases in the 4.21.x train; 4.22.7M and below releases in the 4.22.x train; 4.23.5M and below releases in the 4.23.x train; 4.24.2F and below releases in the 4.24.x train.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-28T18:28:38.000000Z"}, {"uuid": "db100e1a-7521-4d3f-a819-7bf89eba0861", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26563", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/806", "content": "CVE-2020-26563 ObjectPlanet Opinio 7.12 XSS\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-26563_ObjectPlanet_Opinio_7.12_XSS%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T04:42:01.000000Z"}, {"uuid": "931f2620-7288-43be-b8a2-bf16fa11bc0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26564", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/810", "content": "CVE-2020-26564 ObjectPlanet Opinio 7.13/7.14 XML \u6ce8\u5165\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-26564_ObjectPlanet_Opinio_7.13/7.14_XML_%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T04:42:01.000000Z"}, {"uuid": "63ef4a08-e29c-47a1-adea-44aebdb3b384", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-2656", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2629", "content": "The INFILTRATE effect: 6 bugs in 6 months (PoCs):\n- LPE via xscreensaver (CVE-2019-3010);\n- Low impact information disclosure via Solaris xlock (CVE-2020-2656);\n- LPE via CDE (CVE-2020-2696, CVE-2020-2944);\n- Stack-based buffer overflow in CDE libDtSvc (CVE-2020-2851);\n- Heap-based buffer overflow in Solaris whodo and w commands (CVE-2020-2771)\nhttps://github.com/0xdea/raptor_infiltrate20", "creation_timestamp": "2021-02-03T12:43:01.000000Z"}, {"uuid": "eb60ce74-9db5-45b5-a073-39e92e94e094", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26567", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/1883", "content": "#exploit \nCVE-2020-26567:\nD-Link DSR-250N (>= 3.12) - Denial Of Service\nhttps://packetstormsecurity.com/files/159516/rt-sa-2020-002.txt", "creation_timestamp": "2022-09-08T16:16:00.000000Z"}, {"uuid": "28623532-f13a-43b1-bb53-e27542347d1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26561", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2068", "content": "#WLAN_Security\nTechnical Advisory - Linksys Broadband Router WRT160NL - Authenticated Remote Buffer Overflow (PoC for CVE-2020-26561)\nhttps://research.nccgroup.com/2020/10/20/wrt160nl-cve-2020-26561-bof", "creation_timestamp": "2022-05-27T12:54:32.000000Z"}, {"uuid": "51e7ce49-94de-4aa8-8f01-174328399004", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26566", "type": "seen", "source": "https://t.me/cibsecurity/15588", "content": "\u203c CVE-2020-26566 \u203c\n\nA Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-26T21:29:10.000000Z"}, {"uuid": "a6882f43-6fba-42fd-b769-952397faa41c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-2656", "type": "seen", "source": "https://t.me/cissp/2280", "content": "SCADA Security\nThe Rockwell Automation Allen-Bradley Flex I/O input/output device is vulnerable to a denial-of-service vulnerability (PoC for CVE-2020-6088)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1008\n\nMalware analysis\n1. Excel spreadsheets push SystemBC malware\nhttps://isc.sans.edu/diary/rss/27060\n2. New Example of XSL Script Processing aka \"Mitre T1220\"\nhttps://isc.sans.edu/forums/diary/New+Example+of+XSL+Script+Processing+aka+Mitre+T1220/27056\n3. Backdoored Browser Extensions Hid Malicious Traffic in Analytics Requests\nhttps://decoded.avast.io/janvojtesek/backdoored-browser-extensions-hid-malicious-traffic-in-analytics-requests\n4. Kobalos - A complex Linux threat to high performance computing infrastructure\nhttps://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure\n]-> Report in .pdf:\nhttps://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf\n\nThe INFILTRATE effect: 6 bugs in 6 months (PoCs):\n- LPE via xscreensaver (CVE-2019-3010);\n- Low impact information disclosure via Solaris xlock (CVE-2020-2656);\n- LPE via CDE (CVE-2020-2696, CVE-2020-2944);\n- Stack-based buffer overflow in CDE libDtSvc (CVE-2020-2851);\n- Heap-based buffer overflow in Solaris whodo and w commands (CVE-2020-2771)\nhttps://github.com/0xdea/raptor_infiltrate20\n\nCVE-2021-1791:\nApple macOS - Fairplay OOB Read PoC\nhttps://gist.github.com/pwn0rz/e34ab9f6e46956621a9d4f98cf222320\n\nThreat Research\n1. Spoofing and Attacking With Skype (PoC):\n- Spoofing Links/File Names/File Size/Shared Contacts\n- Crash Skype For Any User\n- Spear Phishing With Skype\u2019s Domain\n- Breaking Out Of The Chat Bubble\nhttps://blog.thecybersecuritytutor.com/spoofing-and-attacking-with-skype\n2. The State of 0-day In the Wild Exploitation\nhttps://github.com/maddiestone/ConPresentations/blob/master/Enigma2021.StateOf0day.pdf", "creation_timestamp": "2026-09-01T17:01:02.780476Z"}, {"uuid": "a5bc437e-4393-49ae-8b37-25add071f161", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26564", "type": "seen", "source": "https://t.me/hacking_Attack/18404", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 / 7.14 XML Injection\n\nhttps://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png \nObjectPlanet Opinio versions 7.13 and 7.14 suffer from an XML external entity injection vulnerability.\n\nMD5 | 42b0801a736a8c5f0e5d56cd04363a4e\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26564\n\n# Exploit Title: ObjectPlanet Opinio version 7.13/7.14 allows XXE injection\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26564\n\n# Timeline\n- September 2020: Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26564\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 and 7.14 is vulnerable to XXE injection.\n\n# 3. Proof of Concept\n\n### XXE leading to local file disclosure ###\n\nStep 1: \n\nURL: /opinio/admin/file.do?action=viewEditFileResource&resourceType=6&resourcePatch=upload/css/common/blueSurvey.css\n\nOpinio allows an administrative user to edit local CSS files, this is used to change the contents of a CSS file to a dtd reference file for the XXE injection\nThe existing blueSurvey.css file was chosen for this PoC. Replace the contents of the file with: \n-------------------------------------------------------\n\nStep 2: \n\nUtilize Opinios survey module and create a generic survey template. Export the template .xml file and add this snippet into the top of the .xml file:\n\">\n\"file:////C:\\\n%dtd;\n\nEnsure the surveyIntro tag is inserted with the following payload (This will output the result in the\nsurveyIntro field):\n\n> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to. \n\nImport the modified .xml file to: \n/survey/admin/folderSurvey.do?action=viewImportSurvey['importFile']\n\n-------------------------------------------------------\n\nStep 3: \n\nThe C:\\Users\\ directory can be viewed at :\n/opinio/admin/preview.do?action=previewSurvey&surveyId=<survey_id\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:30.386577Z"}, {"uuid": "3255e775-f3f9-48c5-afd5-99b3e7f25fcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26563", "type": "seen", "source": "https://t.me/hacking_Attack/18220", "content": "Exploit Collector\nObjectPlanet Opinio 7.12 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png ObjectPlanet Opinio version 7.12 suffers from reflective and persistent cross site scripting vulnerabilities.\n\nMD5 | 9b86eabdb364ff978a10f286fc4d44d6Download # Exploit Title: ObjectPlanet Opinio 7.12 allows Cross-Site Scripting\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Ang Kar Min (https://www.linkedin.com/in/karmin-ang)\n# CVE: CVE-2020-26563\n\n# Timeline\n- September 2019:  Initial discovery\n- July 2020:  Reported to ObjectPlanet\n- August 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  Published CVE-2020-26563\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 is vulnerable to stored Cross-Site Scripting (Stored XSS) and reflected Cross-Site Scripting (Reflected XSS).\n\n# 3. Proof of Concept\n\n### Reflected XSS executed in URL ###\n\nThe following payload was executed when injected as part of the URL\"/survey/admin/surveyAdmin.do?action=viewSurveyAdmin&surveyId=1234\":\n\n\u201c&zwzc4%22%3e%3cinput%20type%3dtext%20autofocus%20onfocus%3dconfirm(1)%2f%2f\u201d \n\nAffected URL:/survey/admin/surveyAdmin.do?\n### Stored XSS ###\n\nStored XSS payload such as \u201c can be saved in various parameter fields. The malicious payload is executed when a user visits a page that preview or published the payloads.\n\nStored XSS payload such \u201c can be saved in various parameter fields and executed when a user visits a page where the payload is retrieved. For example, a survey question can be created as part of a survey to store the malicious payload. When this survey previewed, the payload will be retrieved and trigger the XSS vulnerability. \n\nThis stored XSS vulnerability affects any page where the affected parameters are accepted and triggered similarly as described in the previous example.\nAffected URL(s) and Parameter(s):\n- /survey/admin/question.do \n'questionText', 'ratingMinText', 'ratingMaxText', 'ratingNALabel', 'multMinError', 'numError', 'numPrefix', 'numPostfix', 'numReqError', 'dropdownLabel',  parameters\n\n- /survey/admin/section.do \n'title' parameter\n\n- /survey/admin/sectionText.do \n'text' parameter\n\n- /survey/admin/plugin.do \n'plugin_survey_closed_message', 'plugin_restrict_nrics', '&plugin_survey_email_content' parameter\n\n- /survey/admin/confirm.do \n'confirmMessageKeyParam', \u2018org.apache.struts.taglib.html.TOKEN\u2019 parameter\n\n- /survey/admin/folder.do \n'msgKey' parameter\n\n- /survey/admin/file.do \n'resourceName', \u2018resourcePath\u2019 parameter\n\n- /survey/admin/setup.do \n'characterEncoding', 'emailForErrors', 'fromEmail', 'language', 'systemBaseUrl' parameters\n\n- /survey/admin/questionList.do?action=viewQuestionList&surveyId=1806 \narbitrarily supplied URL parameter\n\n- /survey/admin/resources.do?action=viewResourcesByType&resourceType=8&fileListType=6125&selectedPreviewLocation=&selectedPreviewHeight=&selectedPreviewWidth=&selectedRadioId=select1_\u00a9ToPosition=-1&isSimpleLayout=false \narbitrarily supplied URL parameter\n\n- /survey/admin/surveyAdmin.do?action=viewSurveyAdmin&surveyId=3404&isPoll=1 \narbitrarily supplied URL parameter\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nAng Kar Min (https://www.linkedin.com/in/karmin-ang) Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:30.656991Z"}, {"uuid": "881a20bd-7a37-431c-abfc-79abc2abb09d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26564", "type": "seen", "source": "https://t.me/hacking_Attack/18406", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 Shell Upload\n\nhttps://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png \nObjectPlanet Opinio version 7.13 suffers from a remote shell upload vulnerability.\n\nMD5 | 428a660ba8fcf617d5de88b7920acbe4\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26806\n\n# Exploit Title: ObjectPlanet Opinio version 7.13 allows unrestricted file upload\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26806\n\n# Timeline\n- September 2020:  Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26806\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 is vulnerable to unrestricted file uploads\n\n# 3. Proof of Concept\n\n### Unrestricted File Upload leading to RCE ###\n\nStep 1: \n\nURL: /opinio/admin/file.do\n\nOpinio allows an administrative user to edit local CSS files. This file editing function however does not validate if the HTTP POST parameters are tampered with.\n\nPost parameters to tamper with:\n- filePath\n- fileContent\n\nThe base directory can be guessed via the information under Setup >> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to. \n\nThe file path can be tampered with for e.g. : /upload/css/common/../../../admin/shell.jsp\nThe fileContent value was tampered with a JSP webshell for this PoC and a webshell was acheieved \nFor our PoC, we could view the web.xml file using an XXE vulnerability CVE-2020-26564 and identify which JSP files were allowed be loaded and replaced the contents of that JSP file with the webshell code\n\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n\n-------------------------------------------------------\n\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:30.466414Z"}, {"uuid": "a8abbaa6-3b23-419a-8634-81b74d687f33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26565", "type": "seen", "source": "https://t.me/hacking_Attack/18410", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 Expression Language Injection\n\nhttps://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png \nObjectPlanet Opinio version 7.13 suffers from an expression language injection vulnerability.\n\nMD5 | e4ac02c7c40ce27bf82fc181349ac136\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26565\n\n# Exploit Title: ObjectPlanet Opinio version 7.13 allows expression language injection\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26565\n\n# Timeline\n- September 2020:  Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26565\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 is vulnerable to expression language injection\n\n# 3. Proof of Concept\n\n### Expression Language Injection leading to sensitive information disclosure ###\n\nStep 1: \n\nURL: /opinio/admin/permissionList.do?userId=1&from=$%7b7%2a7%7d\nPayload: ${7*7} - URL encoded\n\nThe \"from\" parameter is vulnerable to Expression Language injection and this was validated by inspecting the loaded page source which executed the URL encoded payload to return 49\n\nThis vulnerability can be used to enumerate the sensitive information about the web server. Some examples of payloads that executed successfully are:\n- ${pageContext.request.serverName} - returned server name\n- ${pageContext.serveletContext.serverInfo} - returned server information\n- ${pageContext.servletConfig.class} - returned information about the Apache server \n\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n\n-------------------------------------------------------\n\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:30.514751Z"}, {"uuid": "27068b25-2bc6-4b3f-80ef-39ec94a3c8bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26564", "type": "seen", "source": "https://t.me/hacking_Attack/18404", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 / 7.14 XML Injection\n\nhttps://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png \nObjectPlanet Opinio versions 7.13 and 7.14 suffer from an XML external entity injection vulnerability.\n\nMD5 | 42b0801a736a8c5f0e5d56cd04363a4e\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26564\n\n# Exploit Title: ObjectPlanet Opinio version 7.13/7.14 allows XXE injection\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26564\n\n# Timeline\n- September 2020: Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26564\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 and 7.14 is vulnerable to XXE injection.\n\n# 3. Proof of Concept\n\n### XXE leading to local file disclosure ###\n\nStep 1: \n\nURL: /opinio/admin/file.do?action=viewEditFileResource&resourceType=6&resourcePatch=upload/css/common/blueSurvey.css\n\nOpinio allows an administrative user to edit local CSS files, this is used to change the contents of a CSS file to a dtd reference file for the XXE injection\nThe existing blueSurvey.css file was chosen for this PoC. Replace the contents of the file with: \n-------------------------------------------------------\n\nStep 2: \n\nUtilize Opinios survey module and create a generic survey template. Export the template .xml file and add this snippet into the top of the .xml file:\n\">\n\"file:////C:\\\n%dtd;\n\nEnsure the surveyIntro tag is inserted with the following payload (This will output the result in the\nsurveyIntro field):\n\n> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to. \n\nImport the modified .xml file to: \n/survey/admin/folderSurvey.do?action=viewImportSurvey['importFile']\n\n-------------------------------------------------------\n\nStep 3: \n\nThe C:\\Users\\ directory can be viewed at :\n/opinio/admin/preview.do?action=previewSurvey&surveyId=<survey_id\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:04.956916Z"}, {"uuid": "9d70beef-6f22-4e23-840b-c19c96a09c6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26564", "type": "seen", "source": "https://t.me/hacking_Attack/18406", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 Shell Upload\n\nhttps://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png \nObjectPlanet Opinio version 7.13 suffers from a remote shell upload vulnerability.\n\nMD5 | 428a660ba8fcf617d5de88b7920acbe4\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26806\n\n# Exploit Title: ObjectPlanet Opinio version 7.13 allows unrestricted file upload\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26806\n\n# Timeline\n- September 2020:  Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26806\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 is vulnerable to unrestricted file uploads\n\n# 3. Proof of Concept\n\n### Unrestricted File Upload leading to RCE ###\n\nStep 1: \n\nURL: /opinio/admin/file.do\n\nOpinio allows an administrative user to edit local CSS files. This file editing function however does not validate if the HTTP POST parameters are tampered with.\n\nPost parameters to tamper with:\n- filePath\n- fileContent\n\nThe base directory can be guessed via the information under Setup >> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to. \n\nThe file path can be tampered with for e.g. : /upload/css/common/../../../admin/shell.jsp\nThe fileContent value was tampered with a JSP webshell for this PoC and a webshell was acheieved \nFor our PoC, we could view the web.xml file using an XXE vulnerability CVE-2020-26564 and identify which JSP files were allowed be loaded and replaced the contents of that JSP file with the webshell code\n\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n\n-------------------------------------------------------\n\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:05.036236Z"}, {"uuid": "dba6cd20-dad5-45bc-bda5-1e6deae1df7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26565", "type": "seen", "source": "https://t.me/hacking_Attack/18410", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 Expression Language Injection\n\nhttps://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png \nObjectPlanet Opinio version 7.13 suffers from an expression language injection vulnerability.\n\nMD5 | e4ac02c7c40ce27bf82fc181349ac136\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26565\n\n# Exploit Title: ObjectPlanet Opinio version 7.13 allows expression language injection\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26565\n\n# Timeline\n- September 2020:  Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26565\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 is vulnerable to expression language injection\n\n# 3. Proof of Concept\n\n### Expression Language Injection leading to sensitive information disclosure ###\n\nStep 1: \n\nURL: /opinio/admin/permissionList.do?userId=1&from=$%7b7%2a7%7d\nPayload: ${7*7} - URL encoded\n\nThe \"from\" parameter is vulnerable to Expression Language injection and this was validated by inspecting the loaded page source which executed the URL encoded payload to return 49\n\nThis vulnerability can be used to enumerate the sensitive information about the web server. Some examples of payloads that executed successfully are:\n- ${pageContext.request.serverName} - returned server name\n- ${pageContext.serveletContext.serverInfo} - returned server information\n- ${pageContext.servletConfig.class} - returned information about the Apache server \n\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n\n-------------------------------------------------------\n\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:05.078707Z"}, {"uuid": "11dae5a7-430d-4e34-bb55-f66369d0930c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26563", "type": "seen", "source": "https://t.me/hacking_Attack/18220", "content": "Exploit Collector\nObjectPlanet Opinio 7.12 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png ObjectPlanet Opinio version 7.12 suffers from reflective and persistent cross site scripting vulnerabilities.\n\nMD5 | 9b86eabdb364ff978a10f286fc4d44d6Download # Exploit Title: ObjectPlanet Opinio 7.12 allows Cross-Site Scripting\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Ang Kar Min (https://www.linkedin.com/in/karmin-ang)\n# CVE: CVE-2020-26563\n\n# Timeline\n- September 2019:  Initial discovery\n- July 2020:  Reported to ObjectPlanet\n- August 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  Published CVE-2020-26563\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 is vulnerable to stored Cross-Site Scripting (Stored XSS) and reflected Cross-Site Scripting (Reflected XSS).\n\n# 3. Proof of Concept\n\n### Reflected XSS executed in URL ###\n\nThe following payload was executed when injected as part of the URL\"/survey/admin/surveyAdmin.do?action=viewSurveyAdmin&surveyId=1234\":\n\n\u201c&zwzc4%22%3e%3cinput%20type%3dtext%20autofocus%20onfocus%3dconfirm(1)%2f%2f\u201d \n\nAffected URL:/survey/admin/surveyAdmin.do?\n### Stored XSS ###\n\nStored XSS payload such as \u201c can be saved in various parameter fields. The malicious payload is executed when a user visits a page that preview or published the payloads.\n\nStored XSS payload such \u201c can be saved in various parameter fields and executed when a user visits a page where the payload is retrieved. For example, a survey question can be created as part of a survey to store the malicious payload. When this survey previewed, the payload will be retrieved and trigger the XSS vulnerability. \n\nThis stored XSS vulnerability affects any page where the affected parameters are accepted and triggered similarly as described in the previous example.\nAffected URL(s) and Parameter(s):\n- /survey/admin/question.do \n'questionText', 'ratingMinText', 'ratingMaxText', 'ratingNALabel', 'multMinError', 'numError', 'numPrefix', 'numPostfix', 'numReqError', 'dropdownLabel',  parameters\n\n- /survey/admin/section.do \n'title' parameter\n\n- /survey/admin/sectionText.do \n'text' parameter\n\n- /survey/admin/plugin.do \n'plugin_survey_closed_message', 'plugin_restrict_nrics', '&plugin_survey_email_content' parameter\n\n- /survey/admin/confirm.do \n'confirmMessageKeyParam', \u2018org.apache.struts.taglib.html.TOKEN\u2019 parameter\n\n- /survey/admin/folder.do \n'msgKey' parameter\n\n- /survey/admin/file.do \n'resourceName', \u2018resourcePath\u2019 parameter\n\n- /survey/admin/setup.do \n'characterEncoding', 'emailForErrors', 'fromEmail', 'language', 'systemBaseUrl' parameters\n\n- /survey/admin/questionList.do?action=viewQuestionList&surveyId=1806 \narbitrarily supplied URL parameter\n\n- /survey/admin/resources.do?action=viewResourcesByType&resourceType=8&fileListType=6125&selectedPreviewLocation=&selectedPreviewHeight=&selectedPreviewWidth=&selectedRadioId=select1_\u00a9ToPosition=-1&isSimpleLayout=false \narbitrarily supplied URL parameter\n\n- /survey/admin/surveyAdmin.do?action=viewSurveyAdmin&surveyId=3404&isPoll=1 \narbitrarily supplied URL parameter\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nAng Kar Min (https://www.linkedin.com/in/karmin-ang) Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:05.327848Z"}, {"uuid": "d792f077-5a3b-4aa5-ad14-ed4a1847b97d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-2656", "type": "seen", "source": "https://t.me/cissp/2280", "content": "SCADA Security\nThe Rockwell Automation Allen-Bradley Flex I/O input/output device is vulnerable to a denial-of-service vulnerability (PoC for CVE-2020-6088)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1008\n\nMalware analysis\n1. Excel spreadsheets push SystemBC malware\nhttps://isc.sans.edu/diary/rss/27060\n2. New Example of XSL Script Processing aka \"Mitre T1220\"\nhttps://isc.sans.edu/forums/diary/New+Example+of+XSL+Script+Processing+aka+Mitre+T1220/27056\n3. Backdoored Browser Extensions Hid Malicious Traffic in Analytics Requests\nhttps://decoded.avast.io/janvojtesek/backdoored-browser-extensions-hid-malicious-traffic-in-analytics-requests\n4. Kobalos - A complex Linux threat to high performance computing infrastructure\nhttps://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure\n]-> Report in .pdf:\nhttps://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf\n\nThe INFILTRATE effect: 6 bugs in 6 months (PoCs):\n- LPE via xscreensaver (CVE-2019-3010);\n- Low impact information disclosure via Solaris xlock (CVE-2020-2656);\n- LPE via CDE (CVE-2020-2696, CVE-2020-2944);\n- Stack-based buffer overflow in CDE libDtSvc (CVE-2020-2851);\n- Heap-based buffer overflow in Solaris whodo and w commands (CVE-2020-2771)\nhttps://github.com/0xdea/raptor_infiltrate20\n\nCVE-2021-1791:\nApple macOS - Fairplay OOB Read PoC\nhttps://gist.github.com/pwn0rz/e34ab9f6e46956621a9d4f98cf222320\n\nThreat Research\n1. Spoofing and Attacking With Skype (PoC):\n- Spoofing Links/File Names/File Size/Shared Contacts\n- Crash Skype For Any User\n- Spear Phishing With Skype\u2019s Domain\n- Breaking Out Of The Chat Bubble\nhttps://blog.thecybersecuritytutor.com/spoofing-and-attacking-with-skype\n2. The State of 0-day In the Wild Exploitation\nhttps://github.com/maddiestone/ConPresentations/blob/master/Enigma2021.StateOf0day.pdf", "creation_timestamp": "2026-09-02T01:04:53.406817Z"}, {"uuid": "0b5550f2-21fd-4241-8839-9c8bb57403e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26563", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/18220", "content": "Exploit Collector\nObjectPlanet Opinio 7.12 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png ObjectPlanet Opinio version 7.12 suffers from reflective and persistent cross site scripting vulnerabilities.\n\nMD5 | 9b86eabdb364ff978a10f286fc4d44d6Download # Exploit Title: ObjectPlanet Opinio 7.12 allows Cross-Site Scripting\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Ang Kar Min (https://www.linkedin.com/in/karmin-ang)\n# CVE: CVE-2020-26563\n\n# Timeline\n- September 2019:  Initial discovery\n- July 2020:  Reported to ObjectPlanet\n- August 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  Published CVE-2020-26563\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 is vulnerable to stored Cross-Site Scripting (Stored XSS) and reflected Cross-Site Scripting (Reflected XSS).\n\n# 3. Proof of Concept\n\n### Reflected XSS executed in URL ###\n\nThe following payload was executed when injected as part of the URL\"/survey/admin/surveyAdmin.do?action=viewSurveyAdmin&surveyId=1234\":\n\n\u201c&zwzc4%22%3e%3cinput%20type%3dtext%20autofocus%20onfocus%3dconfirm(1)%2f%2f\u201d \n\nAffected URL:/survey/admin/surveyAdmin.do?\n### Stored XSS ###\n\nStored XSS payload such as \u201c can be saved in various parameter fields. The malicious payload is executed when a user visits a page that preview or published the payloads.\n\nStored XSS payload such \u201c can be saved in various parameter fields and executed when a user visits a page where the payload is retrieved. For example, a survey question can be created as part of a survey to store the malicious payload. When this survey previewed, the payload will be retrieved and trigger the XSS vulnerability. \n\nThis stored XSS vulnerability affects any page where the affected parameters are accepted and triggered similarly as described in the previous example.\nAffected URL(s) and Parameter(s):\n- /survey/admin/question.do \n'questionText', 'ratingMinText', 'ratingMaxText', 'ratingNALabel', 'multMinError', 'numError', 'numPrefix', 'numPostfix', 'numReqError', 'dropdownLabel',  parameters\n\n- /survey/admin/section.do \n'title' parameter\n\n- /survey/admin/sectionText.do \n'text' parameter\n\n- /survey/admin/plugin.do \n'plugin_survey_closed_message', 'plugin_restrict_nrics', '&plugin_survey_email_content' parameter\n\n- /survey/admin/confirm.do \n'confirmMessageKeyParam', \u2018org.apache.struts.taglib.html.TOKEN\u2019 parameter\n\n- /survey/admin/folder.do \n'msgKey' parameter\n\n- /survey/admin/file.do \n'resourceName', \u2018resourcePath\u2019 parameter\n\n- /survey/admin/setup.do \n'characterEncoding', 'emailForErrors', 'fromEmail', 'language', 'systemBaseUrl' parameters\n\n- /survey/admin/questionList.do?action=viewQuestionList&surveyId=1806 \narbitrarily supplied URL parameter\n\n- /survey/admin/resources.do?action=viewResourcesByType&resourceType=8&fileListType=6125&selectedPreviewLocation=&selectedPreviewHeight=&selectedPreviewWidth=&selectedRadioId=select1_\u00a9ToPosition=-1&isSimpleLayout=false \narbitrarily supplied URL parameter\n\n- /survey/admin/surveyAdmin.do?action=viewSurveyAdmin&surveyId=3404&isPoll=1 \narbitrarily supplied URL parameter\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nAng Kar Min (https://www.linkedin.com/in/karmin-ang) Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T22:00:06.561770Z"}, {"uuid": "18bca8ac-3684-43c0-96b8-fda18896ab06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26565", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/18410", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 Expression Language Injection\n\nhttps://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png \nObjectPlanet Opinio version 7.13 suffers from an expression language injection vulnerability.\n\nMD5 | e4ac02c7c40ce27bf82fc181349ac136\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26565\n\n# Exploit Title: ObjectPlanet Opinio version 7.13 allows expression language injection\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26565\n\n# Timeline\n- September 2020:  Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26565\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 is vulnerable to expression language injection\n\n# 3. Proof of Concept\n\n### Expression Language Injection leading to sensitive information disclosure ###\n\nStep 1: \n\nURL: /opinio/admin/permissionList.do?userId=1&from=$%7b7%2a7%7d\nPayload: ${7*7} - URL encoded\n\nThe \"from\" parameter is vulnerable to Expression Language injection and this was validated by inspecting the loaded page source which executed the URL encoded payload to return 49\n\nThis vulnerability can be used to enumerate the sensitive information about the web server. Some examples of payloads that executed successfully are:\n- ${pageContext.request.serverName} - returned server name\n- ${pageContext.serveletContext.serverInfo} - returned server information\n- ${pageContext.servletConfig.class} - returned information about the Apache server \n\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n\n-------------------------------------------------------\n\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T22:00:06.715738Z"}, {"uuid": "ff59ad12-e7ed-4120-a9e5-69dece83836f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26564", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/18406", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 Shell Upload\n\nhttps://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png \nObjectPlanet Opinio version 7.13 suffers from a remote shell upload vulnerability.\n\nMD5 | 428a660ba8fcf617d5de88b7920acbe4\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26806\n\n# Exploit Title: ObjectPlanet Opinio version 7.13 allows unrestricted file upload\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26806\n\n# Timeline\n- September 2020:  Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26806\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 is vulnerable to unrestricted file uploads\n\n# 3. Proof of Concept\n\n### Unrestricted File Upload leading to RCE ###\n\nStep 1: \n\nURL: /opinio/admin/file.do\n\nOpinio allows an administrative user to edit local CSS files. This file editing function however does not validate if the HTTP POST parameters are tampered with.\n\nPost parameters to tamper with:\n- filePath\n- fileContent\n\nThe base directory can be guessed via the information under Setup >> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to. \n\nThe file path can be tampered with for e.g. : /upload/css/common/../../../admin/shell.jsp\nThe fileContent value was tampered with a JSP webshell for this PoC and a webshell was acheieved \nFor our PoC, we could view the web.xml file using an XXE vulnerability CVE-2020-26564 and identify which JSP files were allowed be loaded and replaced the contents of that JSP file with the webshell code\n\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n\n-------------------------------------------------------\n\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T22:00:06.814385Z"}, {"uuid": "3a560cca-3c83-42c9-9a4b-cefc947c751d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26564", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/18404", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 / 7.14 XML Injection\n\nhttps://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png \nObjectPlanet Opinio versions 7.13 and 7.14 suffer from an XML external entity injection vulnerability.\n\nMD5 | 42b0801a736a8c5f0e5d56cd04363a4e\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26564\n\n# Exploit Title: ObjectPlanet Opinio version 7.13/7.14 allows XXE injection\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26564\n\n# Timeline\n- September 2020: Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26564\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 and 7.14 is vulnerable to XXE injection.\n\n# 3. Proof of Concept\n\n### XXE leading to local file disclosure ###\n\nStep 1: \n\nURL: /opinio/admin/file.do?action=viewEditFileResource&resourceType=6&resourcePatch=upload/css/common/blueSurvey.css\n\nOpinio allows an administrative user to edit local CSS files, this is used to change the contents of a CSS file to a dtd reference file for the XXE injection\nThe existing blueSurvey.css file was chosen for this PoC. Replace the contents of the file with: \n-------------------------------------------------------\n\nStep 2: \n\nUtilize Opinios survey module and create a generic survey template. Export the template .xml file and add this snippet into the top of the .xml file:\n\">\n\"file:////C:\\\n%dtd;\n\nEnsure the surveyIntro tag is inserted with the following payload (This will output the result in the\nsurveyIntro field):\n\n> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to. \n\nImport the modified .xml file to: \n/survey/admin/folderSurvey.do?action=viewImportSurvey['importFile']\n\n-------------------------------------------------------\n\nStep 3: \n\nThe C:\\Users\\ directory can be viewed at :\n/opinio/admin/preview.do?action=previewSurvey&surveyId=<survey_id\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T22:00:06.870844Z"}, {"uuid": "c910ff64-e97f-4aa6-9d71-60a6f4639e1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26563", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/18220", "content": "Exploit Collector\nObjectPlanet Opinio 7.12 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png ObjectPlanet Opinio version 7.12 suffers from reflective and persistent cross site scripting vulnerabilities.\n\nMD5 | 9b86eabdb364ff978a10f286fc4d44d6Download # Exploit Title: ObjectPlanet Opinio 7.12 allows Cross-Site Scripting\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Ang Kar Min (https://www.linkedin.com/in/karmin-ang)\n# CVE: CVE-2020-26563\n\n# Timeline\n- September 2019:  Initial discovery\n- July 2020:  Reported to ObjectPlanet\n- August 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  Published CVE-2020-26563\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 is vulnerable to stored Cross-Site Scripting (Stored XSS) and reflected Cross-Site Scripting (Reflected XSS).\n\n# 3. Proof of Concept\n\n### Reflected XSS executed in URL ###\n\nThe following payload was executed when injected as part of the URL\"/survey/admin/surveyAdmin.do?action=viewSurveyAdmin&surveyId=1234\":\n\n\u201c&zwzc4%22%3e%3cinput%20type%3dtext%20autofocus%20onfocus%3dconfirm(1)%2f%2f\u201d \n\nAffected URL:/survey/admin/surveyAdmin.do?\n### Stored XSS ###\n\nStored XSS payload such as \u201c can be saved in various parameter fields. The malicious payload is executed when a user visits a page that preview or published the payloads.\n\nStored XSS payload such \u201c can be saved in various parameter fields and executed when a user visits a page where the payload is retrieved. For example, a survey question can be created as part of a survey to store the malicious payload. When this survey previewed, the payload will be retrieved and trigger the XSS vulnerability. \n\nThis stored XSS vulnerability affects any page where the affected parameters are accepted and triggered similarly as described in the previous example.\nAffected URL(s) and Parameter(s):\n- /survey/admin/question.do \n'questionText', 'ratingMinText', 'ratingMaxText', 'ratingNALabel', 'multMinError', 'numError', 'numPrefix', 'numPostfix', 'numReqError', 'dropdownLabel',  parameters\n\n- /survey/admin/section.do \n'title' parameter\n\n- /survey/admin/sectionText.do \n'text' parameter\n\n- /survey/admin/plugin.do \n'plugin_survey_closed_message', 'plugin_restrict_nrics', '&plugin_survey_email_content' parameter\n\n- /survey/admin/confirm.do \n'confirmMessageKeyParam', \u2018org.apache.struts.taglib.html.TOKEN\u2019 parameter\n\n- /survey/admin/folder.do \n'msgKey' parameter\n\n- /survey/admin/file.do \n'resourceName', \u2018resourcePath\u2019 parameter\n\n- /survey/admin/setup.do \n'characterEncoding', 'emailForErrors', 'fromEmail', 'language', 'systemBaseUrl' parameters\n\n- /survey/admin/questionList.do?action=viewQuestionList&surveyId=1806 \narbitrarily supplied URL parameter\n\n- /survey/admin/resources.do?action=viewResourcesByType&resourceType=8&fileListType=6125&selectedPreviewLocation=&selectedPreviewHeight=&selectedPreviewWidth=&selectedRadioId=select1_\u00a9ToPosition=-1&isSimpleLayout=false \narbitrarily supplied URL parameter\n\n- /survey/admin/surveyAdmin.do?action=viewSurveyAdmin&surveyId=3404&isPoll=1 \narbitrarily supplied URL parameter\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nAng Kar Min (https://www.linkedin.com/in/karmin-ang) Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:11.336547Z"}, {"uuid": "953ece79-56d2-4381-a762-833ee16dea8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26565", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/18410", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 Expression Language Injection\n\nhttps://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png \nObjectPlanet Opinio version 7.13 suffers from an expression language injection vulnerability.\n\nMD5 | e4ac02c7c40ce27bf82fc181349ac136\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26565\n\n# Exploit Title: ObjectPlanet Opinio version 7.13 allows expression language injection\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26565\n\n# Timeline\n- September 2020:  Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26565\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 is vulnerable to expression language injection\n\n# 3. Proof of Concept\n\n### Expression Language Injection leading to sensitive information disclosure ###\n\nStep 1: \n\nURL: /opinio/admin/permissionList.do?userId=1&from=$%7b7%2a7%7d\nPayload: ${7*7} - URL encoded\n\nThe \"from\" parameter is vulnerable to Expression Language injection and this was validated by inspecting the loaded page source which executed the URL encoded payload to return 49\n\nThis vulnerability can be used to enumerate the sensitive information about the web server. Some examples of payloads that executed successfully are:\n- ${pageContext.request.serverName} - returned server name\n- ${pageContext.serveletContext.serverInfo} - returned server information\n- ${pageContext.servletConfig.class} - returned information about the Apache server \n\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n\n-------------------------------------------------------\n\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T00:00:11.479804Z"}, {"uuid": "50fb18bd-5bab-4aca-ab12-9dbd85933a7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26564", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/18406", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 Shell Upload\n\nhttps://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png \nObjectPlanet Opinio version 7.13 suffers from a remote shell upload vulnerability.\n\nMD5 | 428a660ba8fcf617d5de88b7920acbe4\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26806\n\n# Exploit Title: ObjectPlanet Opinio version 7.13 allows unrestricted file upload\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26806\n\n# Timeline\n- September 2020:  Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26806\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 is vulnerable to unrestricted file uploads\n\n# 3. Proof of Concept\n\n### Unrestricted File Upload leading to RCE ###\n\nStep 1: \n\nURL: /opinio/admin/file.do\n\nOpinio allows an administrative user to edit local CSS files. This file editing function however does not validate if the HTTP POST parameters are tampered with.\n\nPost parameters to tamper with:\n- filePath\n- fileContent\n\nThe base directory can be guessed via the information under Setup >> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to. \n\nThe file path can be tampered with for e.g. : /upload/css/common/../../../admin/shell.jsp\nThe fileContent value was tampered with a JSP webshell for this PoC and a webshell was acheieved \nFor our PoC, we could view the web.xml file using an XXE vulnerability CVE-2020-26564 and identify which JSP files were allowed be loaded and replaced the contents of that JSP file with the webshell code\n\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n\n-------------------------------------------------------\n\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T00:00:11.567942Z"}, {"uuid": "3f00ea53-67af-4194-9520-92ae9c0c221d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26564", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/18404", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 / 7.14 XML Injection\n\nhttps://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png \nObjectPlanet Opinio versions 7.13 and 7.14 suffer from an XML external entity injection vulnerability.\n\nMD5 | 42b0801a736a8c5f0e5d56cd04363a4e\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26564\n\n# Exploit Title: ObjectPlanet Opinio version 7.13/7.14 allows XXE injection\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26564\n\n# Timeline\n- September 2020: Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26564\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 and 7.14 is vulnerable to XXE injection.\n\n# 3. Proof of Concept\n\n### XXE leading to local file disclosure ###\n\nStep 1: \n\nURL: /opinio/admin/file.do?action=viewEditFileResource&resourceType=6&resourcePatch=upload/css/common/blueSurvey.css\n\nOpinio allows an administrative user to edit local CSS files, this is used to change the contents of a CSS file to a dtd reference file for the XXE injection\nThe existing blueSurvey.css file was chosen for this PoC. Replace the contents of the file with: \n-------------------------------------------------------\n\nStep 2: \n\nUtilize Opinios survey module and create a generic survey template. Export the template .xml file and add this snippet into the top of the .xml file:\n\">\n\"file:////C:\\\n%dtd;\n\nEnsure the surveyIntro tag is inserted with the following payload (This will output the result in the\nsurveyIntro field):\n\n> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to. \n\nImport the modified .xml file to: \n/survey/admin/folderSurvey.do?action=viewImportSurvey['importFile']\n\n-------------------------------------------------------\n\nStep 3: \n\nThe C:\\Users\\ directory can be viewed at :\n/opinio/admin/preview.do?action=previewSurvey&surveyId=<survey_id\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T00:00:23.544862Z"}, {"uuid": "d5a7a2b2-c5a1-46d9-83bf-eb3cadafa27b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-2656", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2280", "content": "SCADA Security\nThe Rockwell Automation Allen-Bradley Flex I/O input/output device is vulnerable to a denial-of-service vulnerability (PoC for CVE-2020-6088)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1008\n\nMalware analysis\n1. Excel spreadsheets push SystemBC malware\nhttps://isc.sans.edu/diary/rss/27060\n2. New Example of XSL Script Processing aka \"Mitre T1220\"\nhttps://isc.sans.edu/forums/diary/New+Example+of+XSL+Script+Processing+aka+Mitre+T1220/27056\n3. Backdoored Browser Extensions Hid Malicious Traffic in Analytics Requests\nhttps://decoded.avast.io/janvojtesek/backdoored-browser-extensions-hid-malicious-traffic-in-analytics-requests\n4. Kobalos - A complex Linux threat to high performance computing infrastructure\nhttps://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure\n]-> Report in .pdf:\nhttps://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf\n\nThe INFILTRATE effect: 6 bugs in 6 months (PoCs):\n- LPE via xscreensaver (CVE-2019-3010);\n- Low impact information disclosure via Solaris xlock (CVE-2020-2656);\n- LPE via CDE (CVE-2020-2696, CVE-2020-2944);\n- Stack-based buffer overflow in CDE libDtSvc (CVE-2020-2851);\n- Heap-based buffer overflow in Solaris whodo and w commands (CVE-2020-2771)\nhttps://github.com/0xdea/raptor_infiltrate20\n\nCVE-2021-1791:\nApple macOS - Fairplay OOB Read PoC\nhttps://gist.github.com/pwn0rz/e34ab9f6e46956621a9d4f98cf222320\n\nThreat Research\n1. Spoofing and Attacking With Skype (PoC):\n- Spoofing Links/File Names/File Size/Shared Contacts\n- Crash Skype For Any User\n- Spear Phishing With Skype\u2019s Domain\n- Breaking Out Of The Chat Bubble\nhttps://blog.thecybersecuritytutor.com/spoofing-and-attacking-with-skype\n2. The State of 0-day In the Wild Exploitation\nhttps://github.com/maddiestone/ConPresentations/blob/master/Enigma2021.StateOf0day.pdf", "creation_timestamp": "2026-09-11T19:00:05.005216Z"}, {"uuid": "37a50a2f-2cf7-4eda-880f-b6fa9b1686c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-2656", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2280", "content": "SCADA Security\nThe Rockwell Automation Allen-Bradley Flex I/O input/output device is vulnerable to a denial-of-service vulnerability (PoC for CVE-2020-6088)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1008\n\nMalware analysis\n1. Excel spreadsheets push SystemBC malware\nhttps://isc.sans.edu/diary/rss/27060\n2. New Example of XSL Script Processing aka \"Mitre T1220\"\nhttps://isc.sans.edu/forums/diary/New+Example+of+XSL+Script+Processing+aka+Mitre+T1220/27056\n3. Backdoored Browser Extensions Hid Malicious Traffic in Analytics Requests\nhttps://decoded.avast.io/janvojtesek/backdoored-browser-extensions-hid-malicious-traffic-in-analytics-requests\n4. Kobalos - A complex Linux threat to high performance computing infrastructure\nhttps://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure\n]-> Report in .pdf:\nhttps://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf\n\nThe INFILTRATE effect: 6 bugs in 6 months (PoCs):\n- LPE via xscreensaver (CVE-2019-3010);\n- Low impact information disclosure via Solaris xlock (CVE-2020-2656);\n- LPE via CDE (CVE-2020-2696, CVE-2020-2944);\n- Stack-based buffer overflow in CDE libDtSvc (CVE-2020-2851);\n- Heap-based buffer overflow in Solaris whodo and w commands (CVE-2020-2771)\nhttps://github.com/0xdea/raptor_infiltrate20\n\nCVE-2021-1791:\nApple macOS - Fairplay OOB Read PoC\nhttps://gist.github.com/pwn0rz/e34ab9f6e46956621a9d4f98cf222320\n\nThreat Research\n1. Spoofing and Attacking With Skype (PoC):\n- Spoofing Links/File Names/File Size/Shared Contacts\n- Crash Skype For Any User\n- Spear Phishing With Skype\u2019s Domain\n- Breaking Out Of The Chat Bubble\nhttps://blog.thecybersecuritytutor.com/spoofing-and-attacking-with-skype\n2. The State of 0-day In the Wild Exploitation\nhttps://github.com/maddiestone/ConPresentations/blob/master/Enigma2021.StateOf0day.pdf", "creation_timestamp": "2026-09-12T00:00:32.167195Z"}]}