PT-2025-14541 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 8.0 through 9.1 Description: An issue in OS4ED openSIS allows attackers to execute a directory traversal and delete files by sending a crafted POST request. The attack targets the...

CVE-2025-22923

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile...

PT-2025-14543 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 7.0 through 9.1 Description: A SQL injection vulnerability was discovered in OS4ED openSIS via the table parameter at "/attendance/AttendanceCodes.php". The remote, authenticated attacker requires the admin role to...

CVE-2025-22925

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php. The remote, authenticated attacker requires the admin role to successfully exploit this vulnerability...

CVE-2025-22924

OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stuid parameter at /modules/students/Student.php...

CVE-2025-22923

OS4ED openSIS versions v8.0 through v9.1 are vulnerable to a directory traversal flaw. An attacker can send a crafted POST request to the /Modules.php?modname=users/Staff.php&removefile endpoint to perform unauthorized file deletion . Proof-of-concept (PoC) information has been sighted in the wil...

CVE-2025-22923

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile...

CVE-2025-22924

OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stuid parameter at /modules/students/Student.php...

CVE-2025-22924

OS4ED openSIS versions v7.0 through v9.1 are susceptible to a SQL injection vulnerability. The flaw exists in the stu_id parameter at the /modules/students/Student.php API endpoint. An attacker could exploit this to interact with the underlying MySQL database. To mitigate this risk, it is recomme...

CVE-2020-6140

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6139

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The usernamestfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6144

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this...

CVE-2020-6137

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6142

A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can cause local file inclusion. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6138

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6143

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this...

CVE-2020-6141

An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2024-51211

SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $usernamestnid parameter, which can be manipulated by an attacker to inject arbitrary SQL commands...

CVE-2024-51211

SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $usernamestnid parameter, which can be manipulated by an attacker to inject arbitrary SQL commands...

PT-2024-34564 · Os4Ed · Opensis Classic

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS-Classic version 9.1 Description: A SQL injection issue exists due to improper input validation of the username stn id parameter in the resetuserinfo.php file, allowing an attacker to inject arbitrary SQL commands. Recommendation...