PT-2023-26664

Name of the Vulnerable Software and Affected Versions openSIS Classic version 9.0 Description The issue allows an unauthenticated remote attacker to access any student's files. This is achieved by visiting the "/assets/studentfiles/-" API endpoint, where studentId and filename are variables that...

CVE-2023-38884: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference IDOR vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/ - '...