Opensis Security Vulnerabilities and Issues — Opensis CVE List

Lucene search

Os4edOpensis

11 matches found

CVE•added 2022/03/03 2:15 p.m.•77 views

CVE-2021-40635

OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php. An attacker can inject a SQL query to extract information from the database.

7.5CVSS7.6AI score0.00364EPSS

CVE•added 2020/07/01 3:15 p.m.•72 views

CVE-2020-13383

openSIS through 7.4 allows Directory Traversal.

7.5CVSS7.5AI score0.42118EPSS

CVE•added 2013/12/09 4:36 p.m.•70 views

CVE-2013-1349

Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter.

7.5CVSS7.8AI score0.70857EPSS

CVE•added 2022/03/03 2:15 p.m.•64 views

CVE-2021-40636

OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database.

7.5CVSS7.8AI score0.00364EPSS

CVE•added 2022/04/11 2:15 p.m.•62 views

CVE-2022-27041

Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases.

7.5CVSS7.5AI score0.00412EPSS

CVE•added 2020/12/04 4:15 p.m.•43 views

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users.

7.5CVSS7.7AI score0.01184EPSS

CVE•added 2025/04/02 9:15 p.m.•43 views

CVE-2025-22925

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php. The remote, authenticated attacker requires the admin role to successfully exploit this vulnerability.

7.5CVSS8.2AI score0.00146EPSS

CVE•added 2014/10/20 6:55 p.m.•42 views

CVE-2014-8366

SQL injection vulnerability in openSIS 4.5 through 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php.

7.5CVSS8.8AI score0.0036EPSS

CVE•added 2025/04/03 2:15 p.m.•35 views

CVE-2025-22931

An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff members.

7.5CVSS7.2AI score0.0008EPSS

CVE•added 2023/11/20 7:15 p.m.•31 views

CVE-2023-38879

The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'.

7.5CVSS7.4AI score0.16079EPSS

CVE•added 2023/11/20 7:15 p.m.•13 views

CVE-2023-38884

An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/-'

7.5CVSS7.5AI score0.00356EPSS