323 matches found
CVE-2025-22928
OS4ED openSIS v7.0–v9.1 contains a SQL injection in the Inbox module (cp_id parameter at /modules/messages/Inbox.php). Root cause: lack of input sanitization allowing crafted cp_id values to affect the underlying query. Impact is indicated as high (CVSS 3.1: CRITICAL, 9.8) with potential unauthen...
PT-2025-14636 · Os4Ed · Os4Ed Opensis
Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 8.0 through 9.1 Description: The issue allows attackers to execute a directory traversal by sending a crafted POST request to "/Modules.php?modname=messaging/Inbox.php&modfunc=save&filename". This enables attackers to...
CVE-2025-22928
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cpid parameter at /modules/messages/Inbox.php...
CVE-2025-22927
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...
CVE-2025-22929
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filterid parameter at /students/StudentFilters.php...
CVE-2025-22931
OS4ED openSIS vulnerable to an insecure direct object reference (IDOR) in the /assets/stafffiles component affecting versions 7.0 through 9.1. Unauthenticated attackers can access files uploaded by staff members. The CVSS 3.1 base score is 7.5 (HIGH); attack vector NETWORK, scope UNCHANGED, confi...
CVE-2025-22926
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...
CVE-2025-22929
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filterid parameter at /students/StudentFilters.php...
CVE-2025-22930
Summary: OS4ED openSIS versions 7.0–9.1 are documented to contain a SQL injection vulnerability via the groupid parameter in the endpoint /messaging/Group.php . The issue appears in multiple feeds (NVD, Red Hat, OSV, CVE listings) and is characterized by an injection flaw in a user-supplied group...
CVE-2025-22927
CVE-2025-22927 affects OS4ED openSIS v8.0–v9.1. A directory-traversal is possible via a crafted POST to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename, enabling access/alteration of files outside the intended directory. The CVSSv3.1 base score is 9.1 (CRITICAL) with Network attack...
PT-2025-14701 · Os4Ed · Os4Ed Opensis
Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 8.0 through 9.1 Description: The issue allows attackers to execute a directory traversal by sending a crafted POST request to "/Modules.php?modname=messaging/Inbox.php&modfunc=save&filename". This enables them to...
CVE-2025-22931
An insecure direct object reference IDOR in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff members...
CVE-2025-22926
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...
CVE-2025-22928
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cpid parameter at /modules/messages/Inbox.php...
CVE-2025-22929
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filterid parameter at /students/StudentFilters.php...
CVE-2025-22927
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...
PT-2025-14639 · Os4Ed · Os4Ed Opensis
Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 7.0 through 9.1 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the groupid parameter at the "/messaging/Group.php" endpoint. Recommendations: For OS4ED openSI...
CVE-2025-22926
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...
