CVE-2025-22923

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile...

CVE-2025-22924

OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stuid parameter at /modules/students/Student.php...

PT-2025-14541 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 8.0 through 9.1 Description: An issue in OS4ED openSIS allows attackers to execute a directory traversal and delete files by sending a crafted POST request. The attack targets the...

PT-2025-14542 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 7.0 through 9.1 Description: The issue is a SQL injection vulnerability via the stu id parameter at the "/modules/students/Student.php" API endpoint. Recommendations: For OS4ED openSIS versions 7.0 through 9.1, consider...

CVE-2025-22925

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php. The remote, authenticated attacker requires the admin role to successfully exploit this vulnerability...

CVE-2025-22924

OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stuid parameter at /modules/students/Student.php...

CVE-2025-22925

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php. The remote, authenticated attacker requires the admin role to successfully exploit this vulnerability...

Open Solutions For Education OS4Ed OpenSIS SQL注入漏洞

Open Solutions For Education OS4Ed OpenSIS is commercial grade, secure, scalable and intuitive student information system, school management software from Open Solutions For Education, USA. With all the features to run single or multiple organizations in one installation. Web-based, php code, MyS...

Open Solutions For Education OS4Ed OpenSIS 路径遍历漏洞

Open Solutions For Education OS4Ed OpenSIS is commercial-grade, secure, scalable and intuitive student information system, school management software from Open Solutions For Education, USA. Has all the features to run single or multiple organizations in one installation. Web-based, php code, MySQ...

CVE-2025-22923

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile...

PT-2025-14543 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 7.0 through 9.1 Description: A SQL injection vulnerability was discovered in OS4ED openSIS via the table parameter at "/attendance/AttendanceCodes.php". The remote, authenticated attacker requires the admin role to...

CVE-2025-22923

OS4ED openSIS vulnerability CVE-2025-22923: A directory-traversal flaw in versions 8.0–9.1 can allow an attacker to delete files by sending a crafted POST to /Modules.php?modname=users/Staff.php&removefile. Connected sources confirm affected versions and the targeted endpoint; exploitation detail...

CVE-2025-22925

OS4ED openSIS (v7.0–v9.1) is affected by a SQL injection vulnerability in the /attendance/AttendanceCodes.php endpoint via the table parameter. The flaw requires an authenticated admin to exploit. Impact is high (availability impact stated) with no information on exploitation probability beyond t...

CVE-2025-22924

CVE-2025-22924 affects OS4ED openSIS versions 7.0 through 9.1. The issue is a SQL injection vulnerability in the stu_id parameter exposed at /modules/students/Student.php, caused by improper handling of input in that endpoint. The CVSS 3.1 vector indicates Network attack vector, low attack comple...

CVE-2025-22923

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile...

CVE-2025-22925

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php. The remote, authenticated attacker requires the admin role to successfully exploit this vulnerability...

CVE-2025-22924

OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stuid parameter at /modules/students/Student.php...

CVE-2020-6140

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6139

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The usernamestfemail parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2020-6144

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this...