← Vulnerability feed

Vulnerability record · CVE-2025-13873 · published 2 December 2025

CVE-2025-13873: Objectplanet opinio cross-site scripting vulnerability

OObjectplanet · Opinio

Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.

4.8 CVSS 4.0 Medium EPSS 0.20% · top 91.2% CWE-79 · Cross-site scripting
4.8CVSS 4.0 base score
0.20%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
3 Sep 2026Last modified by NVD

Description

Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.objectplanet.com/opinio/changelog.html Release Notes

Track CVE-2025-13873 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-4472Objectplanet opinio vulnerabilityObjectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which c…EPSS 0.74%8.8CVE-2020-26806Objectplanet opinio path traversal vulnerabilityadmin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because…EPSS 6.0%7.5CVE-2020-26565Objectplanet opinio expression language injection vulnerabilityObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve pos…EPSS 1.7%6.5CVE-2020-26564Objectplanet opinio xml external entity (xxe) vulnerabilityObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic sur…EPSS 1.1%6.1CVE-2020-26563Objectplanet opinio cross-site scripting vulnerabilityObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored X…EPSS 0.98%6.1CVE-2017-10798Objectplanet opinio cross-site scripting vulnerabilityIn ObjectPlanet Opinio before 7.6.4, there is XSS.EPSS 0.64%2.3CVE-2025-13871Objectplanet opinio cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the con…EPSS 0.18%2.1CVE-2025-13872Objectplanet opinio server-side request forgery (ssrf) vulnerabilityBlind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker …EPSS 0.31%

Source: NIST National Vulnerability Database (record CVE-2025-13873), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.