PT-2025-14701 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 8.0 through 9.1 Description: The issue allows attackers to execute a directory traversal by sending a crafted POST request to "/Modules.php?modname=messaging/Inbox.php&modfunc=save&filename". This enables them to...

CVE-2025-22927

The student information management system OS4ED openSIS (versions v8.0 through v9.1 ) is vulnerable to a directory traversal issue. An attacker can execute this by sending a crafted POST request to the /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename endpoint. This vulnerability pot...

CVE-2025-22926

OS4ED openSIS versions v8.0 through v9.1 are vulnerable to a directory traversal issue. Attackers can exploit this by sending a crafted POST request to the /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename endpoint, potentially allowing them to access or manipulate files outside the ...

CVE-2025-22927: Improper Limitation of a Pathname to a Restricted Directory

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...

CVE-2025-22926: Improper Limitation of a Pathname to a Restricted Directory

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...

CVE-2025-22927

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...

CVE-2025-22926

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...

CVE-2025-22926

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...

CVE-2025-22927

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...

CVE-2025-22927

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...

CVE-2025-22926

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename...

CVE-2025-22923

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile...

CVE-2025-22923: Improper Limitation of a Pathname to a Restricted Directory

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile...

CVE-2025-22923

OS4ED openSIS versions v8.0 through v9.1 are vulnerable to a directory traversal flaw. An attacker can send a crafted POST request to the /Modules.php?modname=users/Staff.php&removefile endpoint to perform unauthorized file deletion . No patched versions or specific remediation steps are currentl...

CVE-2025-22923

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile...

CVE-2025-22923

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile...

PT-2025-35790

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30 Description The Chamilo learning management system has an issue due to a lack of validation of XML object sequences. This can allow a remote attacker to execute arbitrary SQL queries. The issue exists in the...

CVE-2025-28221

Tenda W6S v1.0.0.4510 has a Buffer Overflow vulnerability in the setlocaltime function, which allows remote attackers to cause web server crash via parameter time passed to the binary through a POST request...

CVE-2025-28219

Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usbadv.cgi, which allows remote attackers to execute arbitrary commands via parameter "deviceName" passed to the binary through a POST request...

CVE-2025-28220

Tenda W6S v1.0.0.4510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash via parameter funcpara1 passed to the binary through a POST request...