747 matches found
CVE-2025-22931
An insecure direct object reference IDOR in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff members...
CVE-2025-22927
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...
CVE-2025-22929
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filterid parameter at /students/StudentFilters.php...
CVE-2025-22931
OS4ED openSIS vulnerable to an insecure direct object reference (IDOR) in the /assets/stafffiles component affecting versions 7.0 through 9.1. Unauthenticated attackers can access files uploaded by staff members. The CVSS 3.1 base score is 7.5 (HIGH); attack vector NETWORK, scope UNCHANGED, confi...
CVE-2025-22930
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php...
CVE-2025-22931
An insecure direct object reference IDOR in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff members...
CVE-2025-22929
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filterid parameter at /students/StudentFilters.php...
PT-2025-14701 · Os4Ed · Os4Ed Opensis
Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 8.0 through 9.1 Description: The issue allows attackers to execute a directory traversal by sending a crafted POST request to "/Modules.php?modname=messaging/Inbox.php&modfunc=save&filename". This enables them to...
Open Solutions For Education openSIS 安全漏洞
Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, USA. A security vulnerability exists in Open Solutions For Education openSIS versions v8.0 through v9.1 that stems from a directory traversal issue...
Open Solutions For Education openSIS 安全漏洞
Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, USA. A security vulnerability exists in Open Solutions For Education openSIS versions v7.0 through v9.1, which stems from an SQL injection issue with the filterid...
CVE-2025-22930
Summary: OS4ED openSIS versions 7.0–9.1 are documented to contain a SQL injection vulnerability via the groupid parameter in the endpoint /messaging/Group.php . The issue appears in multiple feeds (NVD, Red Hat, OSV, CVE listings) and is characterized by an injection flaw in a user-supplied group...
CVE-2025-22927
CVE-2025-22927 affects OS4ED openSIS v8.0–v9.1. A directory-traversal is possible via a crafted POST to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename, enabling access/alteration of files outside the intended directory. The CVSSv3.1 base score is 9.1 (CRITICAL) with Network attack...
CVE-2025-22926
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...
CVE-2025-22926
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...
Open Solutions For Education openSIS 安全漏洞
Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, USA. A security vulnerability exists in Open Solutions For Education openSIS versions v7.0 through v9.1, which stems from a SQL injection issue with the groupid paramete...
CVE-2025-22927
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...
PT-2025-14639 · Os4Ed · Os4Ed Opensis
Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 7.0 through 9.1 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the groupid parameter at the "/messaging/Group.php" endpoint. Recommendations: For OS4ED openSI...
CVE-2025-22926
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...