Os4ed vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-91107 openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School InforCritical 9.3 · Oct 5, 2026
• CVE-2026-8406 openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module.High 7.1 · Jun 11, 2026
• CVE-2025-65594 OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized databasHigh 8.1 · Dec 9, 2025
• CVE-2025-26186 SQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.phpHigh 8.1 · Jul 15, 2025
• CVE-2021-41691 A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST requeCritical 9.8 · Jun 24, 2025
• CVE-2025-22931 An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files upHigh 7.5 · Apr 3, 2025
• CVE-2025-22930 OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php.Critical 9.8 · Apr 3, 2025
• CVE-2025-22929 OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php.Critical 9.8 · Apr 3, 2025
• CVE-2025-22926 An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaginCritical 9.8 · Apr 3, 2025
• CVE-2025-22928 OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php.Critical 9.8 · Apr 3, 2025
• CVE-2025-22927 An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaginCritical 9.1 · Apr 3, 2025
• CVE-2025-22925 OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php.High 7.5 · Apr 2, 2025
• CVE-2025-22924 OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php.High 8.8 · Apr 2, 2025
• CVE-2025-22923 An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.phpHigh 8.8 · Apr 2, 2025
• CVE-2024-51211 SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file.Critical 9.8 · Nov 8, 2024
• CVE-2024-46626 OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.High 8.8 · Oct 2, 2024
• CVE-2023-38885 OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app.High 8.8 · Nov 20, 2023
• CVE-2023-38884 An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to acHigh 7.5 · Nov 20, 2023
• CVE-2023-38880 The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality.Critical 9.8 · Nov 20, 2023
• CVE-2023-38879 The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filHigh 7.5 · Nov 20, 2023
• CVE-2022-27041 Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract informationHigh 7.5 · Apr 11, 2022
• CVE-2021-40636 OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database.High 7.5 · Mar 3, 2022
• CVE-2021-40635 OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php.High 7.5 · Mar 3, 2022
• CVE-2021-41679 A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.Critical 9.8 · Nov 30, 2021
• CVE-2021-41678 A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.Critical 9.8 · Nov 30, 2021