CVE-2023-38880

The CVE-2023-38880 entry describes a broken access control in OS4ED OpenSIS Classic Community Edition v9.0, where database backups created by an admin are stored in the web root with easily guessable names like opensisBackup.sql. This allows any unauthenticated actor to access a complete database...

CVE-2023-38885

OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery CSRF protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request...

Open Solutions For Education openSIS Security Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, Inc. A security vulnerability exists in Open Solutions For Education openSIS Classic Community Edition v9.0, which originates from a Reflective Cross-Site Scripting XSS...

CVE-2023-38885

OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery CSRF protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request...

CVE-2023-38885

OpenSIS Classic Community Edition version 9.0 is described as lacking cross-site request forgery (CSRF) protection throughout the entire application. The vulnerability could allow an attacker to trick an authenticated user into performing any kind of state-changing request. The connected sources ...

PT-2023-26665 · Unknown · Opensis Classic Community Edition

Name of the Vulnerable Software and Affected Versions: OpenSIS Classic Community Edition version 9.0 Description: The issue lacks cross-site request forgery CSRF protection throughout the application, which may allow an attacker to trick an authenticated user into performing any kind of...

Open Solutions For Education openSIS Security Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education. A security vulnerability exists in Open Solutions For Education openSIS Classic Community Edition v9.0, which stems from a directory traversal vulnerability that allows...

Open Solutions For Education openSIS Security Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, USA. A security vulnerability exists in Open Solutions For Education openSIS Classic Community Edition version v9.0, which stems from the presence of an insecure direct...

CVE-2023-38882

A reflected cross-site scripting XSS vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in 'ForExport.php'...

PT-2023-26662 · Unknown · Opensis Classic

Name of the Vulnerable Software and Affected Versions: openSIS Classic version 9.0 Description: A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This is achieved by including a malicious payload into the include parameter ...

CVE-2023-38879

openSIS Classic Community Edition v9.0 is affected by a path traversal in the filename parameter of DownloadWindow.php, enabling unauthenticated remote reading of arbitrary server files. The Nuclei template for CVE-2023-38879 corroborates the vulnerability, naming the endpoint and impact. Root ca...

Open Solutions For Education openSIS Security Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, USA. A security vulnerability exists in Open Solutions For Education openSIS Classic Community Edition version v9.0, which stems from the presence of a corrupted access...

CVE-2023-38883

CVE-2023-38883 describes a reflected cross-site scripting (XSS) vulnerability in the Open Solutions For Education (OS4ED) openSIS Classic Community Edition v9.0 . The issue affects the web application through the parameter 'ajax' in ParentLookup.php , allowing remote attackers to cause the browse...

CVE-2023-38882

CVE-2023-38882 is a reflected cross-site scripting (XSS) vulnerability in Open Solutions For Education OpenSIS Classic Community Edition v9.0. The issue arises from unvalidated input in the include parameter of ForExport.php, allowing an attacker to craft a payload that executes arbitrary JavaScr...

CVE-2023-38884

An Insecure Direct Object Reference IDOR vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/-'...

CVE-2023-38884

An Insecure Direct Object Reference IDOR vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/-'...

CVE-2022-45962

Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php...

Sql injection

Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php...

CVE-2022-45962

The CVE-2022-45962 entry concerns Open Solutions for Education OpenSIS Community Edition (v8.0 and earlier) vulnerable to SQL Injection via CalendarModal.php. The vulnerability is described as a SQL injection on a PHP calendar modal component, with CVSSv3.1 base impact: High confidentiality impac...

Open Solutions For Education openSIS SQL注入漏洞

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, USA. A security vulnerability exists in Open Solutions for Education openSIS Community Edition v8.0 and earlier versions, which originates from a SQL injection...