CVE-2026-11944 | Medium | 6.5 | 2026-07-14 | openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an a… |
CVE-2026-8406 | | | 2026-06-11 | openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging mod… |
CVE-2025-65594 | High | 8.1 | 2025-12-09 | OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized databa… |
CVE-2025-26186 | High | 8.1 | 2025-07-15 | SQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.php |
CVE-2021-41691 | Critical | 9.8 | 2025-06-24 | A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST requ… |
CVE-2025-22931 | High | 7.5 | 2025-04-03 | An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files u… |
CVE-2025-22930 | Critical | 9.8 | 2025-04-03 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php. |
CVE-2025-22929 | Critical | 9.8 | 2025-04-03 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php. |
CVE-2025-22926 | Critical | 9.8 | 2025-04-03 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messagi… |
CVE-2025-22928 | Critical | 9.8 | 2025-04-03 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php. |
CVE-2025-22927 | Critical | 9.1 | 2025-04-03 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messagi… |
CVE-2025-22925 | High | 7.5 | 2025-04-02 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php. The remote, auth… |
CVE-2025-22924 | High | 8.8 | 2025-04-02 | OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php. |
CVE-2025-22923 | High | 8.8 | 2025-04-02 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.ph… |
CVE-2024-51211 | Critical | 9.8 | 2024-11-08 | SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input… |
CVE-2024-35584 | High | 8.8 | 2024-10-15 | SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition… |
CVE-2024-46626 | High | 8.8 | 2024-10-02 | OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload. |
CVE-2023-38885 | High | 8.8 | 2023-11-20 | OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick… |
CVE-2023-38884 | High | 7.5 | 2023-11-20 | An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to a… |
CVE-2023-38883 | Medium | 6.1 | 2023-11-20 | A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitra… |
CVE-2023-38882 | Medium | 6.1 | 2023-11-20 | A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitra… |
CVE-2023-38881 | Medium | 6.1 | 2023-11-20 | A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitra… |
CVE-2023-38880 | Critical | 9.8 | 2023-11-20 | The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin… |
CVE-2023-38879 | High | 7.5 | 2023-11-20 | The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'fi… |
CVE-2022-45962 | Medium | 6.5 | 2023-02-13 | Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php. |
CVE-2022-27041 | High | 7.5 | 2022-04-11 | Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract informatio… |
CVE-2021-40637 | Medium | 6.1 | 2022-03-03 | OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) in EmailCheckOthers.php. An attacker can inject JavaScript code to get the user's cookie and take o… |
CVE-2021-40636 | High | 7.5 | 2022-03-03 | OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database. |
CVE-2021-40635 | High | 7.5 | 2022-03-03 | OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php. An attacker can inject a SQL query to extract information from t… |
CVE-2021-41679 | Critical | 9.8 | 2021-11-30 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL co… |
CVE-2021-41678 | Critical | 9.8 | 2021-11-30 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL co… |
CVE-2021-41677 | Critical | 9.8 | 2021-11-30 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL co… |
CVE-2021-40618 | Critical | 9.8 | 2021-10-12 | An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in… |
CVE-2021-40617 | Critical | 9.8 | 2021-10-11 | An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php. |
CVE-2021-40543 | Critical | 9.8 | 2021-10-11 | Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET['usrid'] and $_GET… |
CVE-2021-40542 | Medium | 6.1 | 2021-10-11 | Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS). An unauthenticated user can inject and execute JavaScript code through the link_url para… |
CVE-2021-40651 | Medium | 6.5 | 2021-09-29 | OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from th… |
CVE-2021-40310 | Medium | 5.4 | 2021-09-24 | OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss_attn parameter. |
CVE-2021-40309 | High | 8.8 | 2021-09-24 | A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. allows an attacker to inject their own SQL query. The cp_id_m… |
CVE-2021-27341 | Critical | 9.8 | 2021-09-16 | OpenSIS Community Edition version <= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parameter. |
CVE-2021-27340 | Medium | 6.1 | 2021-09-16 | OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter. |
CVE-2021-39379 | Critical | 9.8 | 2021-09-01 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands… |
CVE-2021-39378 | Critical | 9.8 | 2021-09-01 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands… |
CVE-2021-39377 | Critical | 9.8 | 2021-09-01 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands… |
CVE-2021-40353 | Critical | 9.8 | 2021-09-01 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL co… |
CVE-2020-27409 | Medium | 6.1 | 2020-12-04 | OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter. |
CVE-2020-27408 | High | 7.5 | 2020-12-04 | OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change… |
CVE-2020-6144 | Critical | 9.8 | 2020-09-01 | A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5… |
CVE-2020-6143 | Critical | 9.8 | 2020-09-01 | A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5… |
CVE-2020-6142 | Critical | 9.8 | 2020-09-01 | A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can cause local file inclu… |
CVE-2020-6140 | Critical | 9.8 | 2020-09-01 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the password reset page /opens… |
CVE-2020-6139 | Critical | 9.8 | 2020-09-01 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email parameter in the password reset page /opens… |
CVE-2020-6138 | Critical | 9.8 | 2020-09-01 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the password reset page /opensis/ResetUserI… |
CVE-2020-6137 | Critical | 9.8 | 2020-09-01 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the password reset page /opens… |
CVE-2020-6141 | Critical | 9.8 | 2020-09-01 | An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection… |
CVE-2020-6136 | High | 8.8 | 2020-09-01 | An exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQ… |
CVE-2020-6135 | High | 8.8 | 2020-09-01 | An exploitable SQL injection vulnerability exists in the Validator.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL inj… |
CVE-2020-6134 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page MassDropModal.php is vulnerable to SQL inject… |
CVE-2020-6133 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page CourseMoreInfo.php is vulnerable to SQL injec… |
CVE-2020-6132 | High | 8.8 | 2020-09-01 | SQL injection vulnerability exists in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page ChooseCP.php is vulnerable to SQL injection. A… |
CVE-2020-6128 | High | 8.8 | 2020-09-01 | SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. The meet… |
CVE-2020-6127 | High | 8.8 | 2020-09-01 | SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. The id parameter in the page CoursePeriodModal.php is vulnerable to… |
CVE-2020-6126 | High | 8.8 | 2020-09-01 | SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. The course_period_id parameter in the page CoursePeriodModal.php is… |
CVE-2020-6125 | High | 8.8 | 2020-09-01 | An exploitable SQL injection vulnerability exists in the GetSchool.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL inj… |
CVE-2020-6124 | High | 8.8 | 2020-09-01 | An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3. The email parameter in the page EmailCheckOthers.p… |
CVE-2020-6131 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages. The course_period_id parameter in the page MassSchedule… |
CVE-2020-6130 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages. The course_period_id parameter in the page MassDropSess… |
CVE-2020-6129 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages. The course_period_id parameter in the page CpSessionSet… |
CVE-2020-6123 | High | 8.8 | 2020-09-01 | An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3. The email parameter in the page EmailCheck.php is… |
CVE-2020-6122 | High | 8.8 | 2020-09-01 | SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The mn parameter in the page CheckDuplicateStudent.php is vulner… |
CVE-2020-6121 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The ln parameter in the page CheckDuplicateStudent.php is vulne… |
CVE-2020-6120 | High | 8.8 | 2020-09-01 | SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The fn parameter in the page CheckDuplicateStudent.php is vulner… |
CVE-2020-6119 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The byear parameter in the page CheckDuplicateStudent.php is vu… |
CVE-2020-6118 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The bmonth parameter in the page CheckDuplicateStudent.php is v… |
CVE-2020-6117 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The bday parameter in the page CheckDuplicateStudent.php is vul… |
CVE-2020-6637 | Critical | 9.8 | 2020-08-24 | openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php. |
CVE-2020-13383 | High | 7.5 | 2020-07-01 | openSIS through 7.4 allows Directory Traversal. |
CVE-2020-13382 | Critical | 9.1 | 2020-07-01 | openSIS through 7.4 has Incorrect Access Control. |
CVE-2020-13381 | Critical | 9.8 | 2020-07-01 | openSIS through 7.4 allows SQL Injection. |
CVE-2020-13380 | Critical | 9.8 | 2020-07-01 | openSIS before 7.4 allows SQL Injection. |
CVE-2014-8366 | | | 2014-10-20 | SQL injection vulnerability in openSIS 4.5 through 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php. |
CVE-2013-1349 | | | 2013-12-09 | Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter. |