CVE-2025-22931

OS4ED openSIS versions v7.0 through v9.1 are vulnerable to an Insecure Direct Object Reference (IDOR) in the /assets/stafffiles component. This flaw allows unauthenticated attackers to access files uploaded by staff members. As a mitigation, it is recommended to restrict access to the /assets/sta...