Os4ed Opensis
81 CVEs affecting Os4ed Opensis. Latest disclosed: 2026-07-14. Critical: 31, High: 37.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41691 | Critical | 9.8 | 2025-06-24 | A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST requ… |
CVE-2025-22930 | Critical | 9.8 | 2025-04-03 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php. |
CVE-2025-22929 | Critical | 9.8 | 2025-04-03 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php. |
CVE-2025-22926 | Critical | 9.8 | 2025-04-03 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messagi… |
CVE-2025-22928 | Critical | 9.8 | 2025-04-03 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php. |
CVE-2024-51211 | Critical | 9.8 | 2024-11-08 | SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input… |
CVE-2023-38880 | Critical | 9.8 | 2023-11-20 | The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin… |
CVE-2021-41679 | Critical | 9.8 | 2021-11-30 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL co… |
CVE-2021-41678 | Critical | 9.8 | 2021-11-30 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL co… |
CVE-2021-41677 | Critical | 9.8 | 2021-11-30 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL co… |
CVE-2021-40618 | Critical | 9.8 | 2021-10-12 | An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in… |
CVE-2021-40617 | Critical | 9.8 | 2021-10-11 | An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php. |
CVE-2021-40543 | Critical | 9.8 | 2021-10-11 | Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET['usrid'] and $_GET… |
CVE-2021-27341 | Critical | 9.8 | 2021-09-16 | OpenSIS Community Edition version <= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parameter. |
CVE-2021-39379 | Critical | 9.8 | 2021-09-01 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands… |
CVE-2021-39378 | Critical | 9.8 | 2021-09-01 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands… |
CVE-2021-39377 | Critical | 9.8 | 2021-09-01 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands… |
CVE-2021-40353 | Critical | 9.8 | 2021-09-01 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL co… |
CVE-2020-6144 | Critical | 9.8 | 2020-09-01 | A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5… |
CVE-2020-6143 | Critical | 9.8 | 2020-09-01 | A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5… |