Skip to content
OpenAdvisories

Vendor

BroadLearning

3 known vulnerabilities.

Products

eclass 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2019-9885

    eClass platform contains a SQL injection vulnerability

    eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter.

    BroadLearning eclass
  • Critical 9.8
    CVE-2019-9884

    eClass platform contains a Broken Access Control vulnerability

    eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.

    BroadLearning eclass
  • Critical 9.1
    CVE-2019-9886

    eClass platform allows user to download arbitrary files without authentication

    Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1.

    BroadLearning eclass