CVE-2014-9126

CVE-2014-9126 affects Open-School Community Edition 2.2. The vulnerability is described as multiple cross-site scripting (XSS) issues that allow remote attackers to inject arbitrary script/HTML via the YII_CSRF_TOKEN HTTP cookie or through the StudentDocument, StudentCategories, and StudentPrevio...

CVE-2014-9127

Open-School Community Edition 2.2 is affected by CVE-2014-9127: an access control bypass in the export feature allows remote authenticated users to view sensitive data via the r parameter set to export on index.php. The issue enables partial confidentiality impact as described in the CVE entry, w...

CVE-2019-14696

CVE-2019-14696 affects Open-School 3.0 and Community Edition 2.3, exposing a Cross-Site Scripting (XSS) flaw. The vulnerability occurs in the GET parameter osv/index.php?r=students/guardians/create id, allowing injection of arbitrary JavaScript in the victim’s browser. This could enable session h...

CVE-2009-4208

CVE-2009-4208 is a SQL injection vulnerability in the os_news module of Open-school (OS) 1.0. The issue allows remote attackers to inject arbitrary SQL commands via the id parameter in the show action of index.php. Public references (NVD, Exploit-DB) confirm the vulnerability, with a base score o...

CVE-2019-14754

Open-School 3.0 and Community Edition 2.3 are affected by an SQL injection via index.php?r=students/students/document id parameter. The root cause is lack of validation of externally entered SQL statements in the database-based application, allowing an attacker to execute arbitrary SQL commands. ...