Unscored severity · published Oct 20, 2014
CVE-2014-8366
SQL injection vulnerability in openSIS 4.5 through 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php
–
CVSS
2.1%
EPSS
No
On KEV
Description
SQL injection vulnerability in openSIS 4.5 through 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opensis · Os4ed
4.5; 5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8366
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8366
Exploit
http://packetstormsecurity.com/files/127284/openSIS-5.3-SQL-Injection.html
Exploit
http://seclists.org/fulldisclosure/2014/Jun/151
secunia.com
http://secunia.com/advisories/59114
More from Opensis
9.8
CVE-2021-41691
A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to…
9.8
CVE-2025-22930
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php
9.8
CVE-2025-22928
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php
9.8
CVE-2025-22926
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to…
9.8
CVE-2025-22929
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php