Inducer vulnerabilities
We track 5 vulnerabilities in Inducer products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on May 27, 2026.
Latest Inducer vulnerabilities
- 8.7 High severity
relate: Deserialization of Untrusted Data
RELATE is a web-based courseware package. Prior to commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb, RELATE LMS configures its Celery workers to accept and deserialize untrusted 'pickle' data. An attacker who can reach the message broker can execute arbitrary c
- 8.7 High severity
relate: Improper Neutralization of Input During Web Page Generation
RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session,
- 8.1 High severity
relate: Observable Discrepancy
RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue has been patched via commit 2f68e16.
- 8.7 High severity
relate: Use of Insufficiently Random Values
RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make_sign_in_key() function and exam.py's gen_ticket_code() function. This issue has been patched via commit 2f68e16.
- 7.5 High severity
Relate: Improper Neutralization of Special Elements Used in a Template Engine
Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Batch-Issue Exam Tickets function.