Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
88 results · page 1 of 2
Oct 5, 2026openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School InforCVE-2026-91107 · Other software · OS4ED · reported by help@fluidattacks.comCritical 9.3
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
- Product
- openSIS-Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Sep 30, 2026A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3.CVE-2026-103117 · Other software · OS4ED · reported by VulDBLow 2
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- openSIS-Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A weakness has been identified in OS4ED openSIS-Classic up to 9.3.CVE-2026-103116 · Other software · OS4ED · reported by VulDBLow 2.1
A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- openSIS-Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3.CVE-2026-103115 · Other software · OS4ED · reported by VulDBLow 2.1
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- openSIS-Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A vulnerability was identified in OS4ED openSIS-Classic up to 9.3.CVE-2026-103114 · Other software · OS4ED · reported by VulDBLow 2.1
A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- openSIS-Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A vulnerability was determined in OS4ED openSIS-Classic up to 9.3.CVE-2026-103113 · Other software · OS4ED · reported by VulDBLow 2
A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argument students can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- openSIS-Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an auCVE-2026-11944 · Other software · OS4ED · reported by help@fluidattacks.comMedium 5.3
openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.
- Product
- openSIS-Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Jun 11, 2026openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module.CVE-2026-8406 · Other software · OS4ED · reported by help@fluidattacks.comHigh 7.1
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.
- Product
- openSIS-Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Dec 9, 2025OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized databasCVE-2025-65594 · Other software · Os4ed · reported by MITREHigh 8.1
OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized database write operations relating to the data of other users.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025SQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.phpCVE-2025-26186 · Other software · Os4ed · reported by MITREHigh 8.1
SQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.php
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST requeCVE-2021-41691 · Other software · Os4ed · reported by MITRECritical 9.8
A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to /TransferredOutModal.php.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files upCVE-2025-22931 · Other software · Os4ed · reported by MITREHigh 7.5
An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff members.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php.CVE-2025-22930 · Other software · Os4ed · reported by MITRECritical 9.8
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php.CVE-2025-22929 · Other software · Os4ed · reported by MITRECritical 9.8
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaginCVE-2025-22926 · Other software · Os4ed · reported by MITRECritical 9.8
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php.CVE-2025-22928 · Other software · Os4ed · reported by MITRECritical 9.8
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaginCVE-2025-22927 · Other software · Os4ed · reported by MITRECritical 9.1
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php.CVE-2025-22925 · Other software · Os4ed · reported by MITREHigh 7.5
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php. The remote, authenticated attacker requires the admin role to successfully exploit this vulnerability.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php.CVE-2025-22924 · Other software · Os4ed · reported by MITREHigh 8.8
OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.phpCVE-2025-22923 · Other software · Os4ed · reported by MITREHigh 8.8
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file.CVE-2024-51211 · Other software · os4ed · reported by MITRECritical 9.8
SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbitrary SQL commands.
- Product
- opensis-classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9CVE-2024-35584 · Other software · opensis · reported by MITREHigh 8.8
SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from "X-Forwarded-For" header and appends it to a SQL INSERT statement directly, leading to SQL Injection.
- Product
- opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.CVE-2024-46626 · Other software · os4ed · reported by MITREHigh 8.8
OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.
- Product
- opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app.CVE-2023-38885 · Other software · Os4ed · reported by MITREHigh 8.8
OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to acCVE-2023-38884 · Other software · Os4ed · reported by MITREHigh 7.5
An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/<studentId>-<filename>'
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrarCVE-2023-38883 · Other software · Os4ed · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' parameter in 'ParentLookup.php'.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrarCVE-2023-38882 · Other software · Os4ed · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in 'ForExport.php'
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrarCVE-2023-38881 · Other software · Os4ed · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the 'calendar_id', 'school_date', 'month' or 'year' parameters in 'CalendarModal.php'.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality.CVE-2023-38880 · Other software · Os4ed · reported by MITRECritical 9.8
The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin generates a database backup, the backup is stored in the web root while the file name has a format of "opensisBackup<date>.sql" (e.g. "opensisBackup07-20-2023.sql"), i.e. can easily be guessed. This file can be accessed by any unauthenticated actor and contains a dump of the whole database including password hashes.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filCVE-2023-38879 · Other software · Os4ed · reported by MITREHigh 7.5
The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php.CVE-2022-45962 · Other software · Os4ed · reported by MITREMedium 6.5
Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordccat.gitbook.iogithub.com
Apr 11, 2022Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract informationCVE-2022-27041 · Other software · Os4ed · reported by MITREHigh 7.5
Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2022OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) in EmailCheckOthers.php.CVE-2021-40637 · Other software · Os4ed · reported by MITREMedium 6.1
OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) in EmailCheckOthers.php. An attacker can inject JavaScript code to get the user's cookie and take over the working session of user.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2022OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database.CVE-2021-40636 · Other software · Os4ed · reported by MITREHigh 7.5
OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2022OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php.CVE-2021-40635 · Other software · Os4ed · reported by MITREHigh 7.5
OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php. An attacker can inject a SQL query to extract information from the database.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.CVE-2021-41679 · Other software · Os4ed · reported by MITRECritical 9.8
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/grades/InputFinalGrades.php, period parameter.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.CVE-2021-41678 · Other software · Os4ed · reported by MITRECritical 9.8
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/users/Staff.php, staff{TITLE] parameter.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.CVE-2021-41677 · Other software · Os4ed · reported by MITRECritical 9.8
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/functions/GetStuListFnc.php &Grade= parameter.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2021An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in CVE-2021-40618 · Other software · Os4ed · reported by MITRECritical 9.8
An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in HoldAddressFields.php.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2021An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php.CVE-2021-40617 · Other software · Os4ed · reported by MITRECritical 9.8
An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2021Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET['usrid'] and $_GET[CVE-2021-40543 · Other software · Os4ed · reported by MITRECritical 9.8
Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET['usrid'] and $_GET['prof_id'] in the PasswordCheck.php file.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2021Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS).CVE-2021-40542 · Other software · Os4ed · reported by MITREMedium 6.1
Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS). An unauthenticated user can inject and execute JavaScript code through the link_url parameter in Ajax_url_encode.php.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2021OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from theCVE-2021-40651 · Other software · Os4ed · reported by MITREMedium 6.5
OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Sep 24, 2021OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss_attn parameter.CVE-2021-40310 · Other software · Os4ed · reported by MITREMedium 5.4
OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss_attn parameter.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2021A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0.CVE-2021-40309 · Other software · Os4ed · reported by MITREHigh 8.8
A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. allows an attacker to inject their own SQL query. The cp_id_miss_attn parameter from TakeAttendance.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request as a user with access to "Take Attendance" functionality to trigger this vulnerability.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2021OpenSIS Community Edition version <= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parameter.CVE-2021-27341 · Other software · Os4ed · reported by MITRECritical 9.8
OpenSIS Community Edition version <= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parameter.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2021OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter.CVE-2021-27340 · Other software · Os4ed · reported by MITREMedium 6.1
OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database.CVE-2021-39379 · Other software · Os4ed · reported by MITRECritical 9.8
A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands to the MySQL (MariaDB) database through the ResetUserInfo.php password_stn_id parameter.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database.CVE-2021-39378 · Other software · Os4ed · reported by MITRECritical 9.8
A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands to the MySQL (MariaDB) database through the NamesList.php str parameter.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database.CVE-2021-39377 · Other software · Os4ed · reported by MITRECritical 9.8
A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands to the MySQL (MariaDB) database through the index.php username parameter.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.