CVE-2025-65239

OpenCode Systems USSD Gateway (OC Release:5, version 6.13.11) is affected by a vulnerability in the 🐀/aux1/ocussd/trace endpoint. Due to incorrect access control , an attacker with low-level privileges can successfully read internal server logs . To remediate this issue, it is recommended to rest...

CVE-2025-65238

The OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 is vulnerable to an incorrect access control flaw within the getSubUsersByProvider function. This security weakness allows an attacker with low-level privileges to bypass intended restrictions to dump user records and gain access to ...

CVE-2025-70614

OpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 is vulnerable to a broken access control flaw within its web-based control panel. An authenticated attacker with low privileges can gain unauthorized access to arbitrary SMS messages by manipulating the company or tenant identifier pa...

CVE-2025-65237

A reflected cross-site scripted (XSS) vulnerability exists in OpenCode Systems USSD Gateway OC Release: 5 . This flaw allows an attacker to execute arbitrary JavaScript within a user's browser by injecting a crafted payload . The vulnerability is associated with CWE-79 (Improper Neutralization of...

CVE-2025-65235

OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 is vulnerable to a SQL injection vulnerability. The flaw exists in the getSubUsersByProvider function due to improper neutralization of special elements in the ID parameter. This vulnerability allows an attacker to interfere with databas...

CVE-2025-65236

The OpenCode Systems USSD Gateway OC Release: 5 is susceptible to a SQL injection vulnerability. The flaw exists in the /occontrolpanel/index.php endpoint due to improper neutralization of special elements in the Session ID parameter. Successful exploitation allows an attacker to manipulate datab...