inxedu records

7 published records for vendor inxedu.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 4
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

7 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
43Plan	CVE-2020-35326No exploit	SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0inxedu · inxedu · CWE-89 Pre-auth SQL injection	Critical9.8	—	13.6%	Jan 18, 2023
40Plan	CVE-2019-7684No exploit	inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file.inxedu · inxedu · CWE-434 Pre-auth File upload	Critical9.8	—	2.1%	Feb 9, 2019
39Monitor	CVE-2020-35430No exploit	SQL Injection in com/inxedu/OS/edu/controller/letter/AdminMsgSystemController in Inxedu v2.0.6 via the ids parameter to admin/letter/delsystinxedu · inxedu · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.1%	Apr 29, 2021
39Monitor	CVE-2024-35570No exploit	An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to executeinxedu · inxedu · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.9%	May 23, 2024
39Monitor	CVE-2020-21152No exploit	SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunctioinxedu · inxedu · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	0.8%	Jan 20, 2023
39Monitor	CVE-2024-35079No exploit	An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading inxedu · inxedu · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.6%	May 23, 2024
39Monitor	CVE-2024-35080No exploit	An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a craftinxedu · inxedu · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.6%	May 23, 2024

CVE-2020-35326
43Plan
SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0
CriticalCVSS 9.8No exploitEPSS 14%
- Pre-auth
- SQL injection
inxedu · inxeduJan 18, 2023
CVE-2019-7684
40Plan
inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
- File upload
inxedu · inxeduFeb 9, 2019
CVE-2020-35430
39Monitor
SQL Injection in com/inxedu/OS/edu/controller/letter/AdminMsgSystemController in Inxedu v2.0.6 via the ids parameter to admin/letter/delsyst
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
inxedu · inxeduApr 29, 2021
CVE-2024-35570
39Monitor
An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- File upload
inxedu · inxeduMay 23, 2024
CVE-2020-21152
39Monitor
SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunctio
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- SQL injection
inxedu · inxeduJan 20, 2023
CVE-2024-35079
39Monitor
An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- File upload
inxedu · inxeduMay 23, 2024
CVE-2024-35080
39Monitor
An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a craft
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- File upload
inxedu · inxeduMay 23, 2024