CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

Design/Logic Flaw

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

CVE-2020-27408

OpenSIS Community Edition up to version 7.6 is affected by an access-control flaw in ResetUserInfo.php that lets an unauthenticated attacker change arbitrary user passwords. The root cause is improper access controls on the ResetUserInfo.php endpoint, enabling password modification without authen...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

Open Solutions For Education openSIS Encryption Problem Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions for Education OSE. A vulnerability exists in OpenSIS Community Edition version 7.6 and prior versions due to an encryption issue that originates from incorrect access controls in the...

PT-2020-16685

Name of the Vulnerable Software and Affected Versions OpenSIS Community Edition versions through 7.6 Description The issue is related to incorrect access controls for the file ResetUserInfo.php, allowing an unauthenticated attacker to change the password of arbitrary users. Recommendations For...

CVE-2020-27408: Improper Authentication

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

CVE-2020-6138

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6137

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6140

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

PT-2020-18952

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the password reset functionality. The uname parameter in the password reset page "/opensis/ResetUserInfo.php" is vulnerable to SQL injection, allowing an attacker to send an...

PT-2020-18951

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the password reset functionality. The password stf email parameter in the "/opensis/ResetUserInfo.php" API endpoint is vulnerable to SQL injection, allowing an attacker to...

PT-2020-18954

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the password reset functionality. The password stf email parameter in the "/opensis/ResetUserInfo.php" API endpoint is vulnerable to SQL injection, allowing an attacker to...

PT-2020-18953

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.3 Description A SQL injection issue exists in the password reset functionality. The username stf email parameter in the "/opensis/ResetUserInfo.php" API endpoint is vulnerable to SQL injection, allowing an attacker to...

CVE-2020-6138: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6139: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The usernamestfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6137: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6140: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...