Priority HIGH 82
SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02256 · Published 2024-11-08 · No fix listed CWE-89
Priority HIGH 76
openSIS through 7.4 allows SQL Injection.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.59028 · Published 2020-07-01 · No fix listed CWE-89
Priority HIGH 73
OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00417 · Published 2025-04-02 · No fix listed CWE-89
Priority HIGH 73
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00885 · Published 2025-04-02 · No fix listed CWE-22
Priority HIGH 73
OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00881 · Published 2024-10-02 · No fix listed CWE-89
Priority HIGH 73
SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.05857 · Published 2024-10-15 · No fix listed CWE-89
Priority HIGH 71
openSIS through 7.4 has Incorrect Access Control.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.52814 · Published 2020-07-01 · No fix listed CWE-306
Priority HIGH 70
OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized database write operations relating to the data of other users.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00288 · Published 2025-12-09 · No fix listed CWE-284
Priority HIGH 70
openSIS through 7.4 allows Directory Traversal.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.67792 · Published 2020-07-01 · No fix listed CWE-22
Priority MEDIUM 64
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00302 · Published 2026-06-11 · No fix listed CWE-639
Priority MEDIUM 62
A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.22669 · Published 2021-09-01 · No fix listed CWE-89
Priority MEDIUM 59
openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.17576 · Published 2020-08-24 · No fix listed CWE-89
Priority MEDIUM 57
A weakness has been identified in OS4ED openSIS-Classic up to 9.3.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.0025 · Published 2026-09-30 · No fix listed CWE-74
Priority MEDIUM 57
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.0025 · Published 2026-09-30 · No fix listed CWE-74
Priority MEDIUM 57
A vulnerability was identified in OS4ED openSIS-Classic up to 9.3.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.002 · Published 2026-09-30 · No fix listed CWE-74
Priority MEDIUM 57
openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server v…
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00481 · Published 2026-07-14 · No fix listed CWE-22
Priority MEDIUM 56
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00262 · Published 2026-09-30 · No fix listed CWE-74
Priority MEDIUM 56
A vulnerability was determined in OS4ED openSIS-Classic up to 9.3.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.0021 · Published 2026-09-30 · No fix listed CWE-74
Priority MEDIUM 54
A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0924 · Published 2020-09-01 · No fix listed CWE-22
Priority MEDIUM 53
A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to /TransferredOutModal.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02071 · Published 2025-06-24 · No fix listed CWE-89
Priority MEDIUM 52
Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.21875 · Published 2013-12-09 · No fix listed CWE-94
Priority MEDIUM 51
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00934 · Published 2025-04-03 · No fix listed CWE-22
Priority MEDIUM 51
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06172 · Published 2020-09-01 · No fix listed CWE-96
Priority MEDIUM 51
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06172 · Published 2020-09-01 · No fix listed CWE-96
Priority MEDIUM 50
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00535 · Published 2025-04-03 · No fix listed CWE-89
Load more
THREATIST.IORead the docs