OP
Product
Opensis
81
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 31High 37Medium 11Low 0
Watch
Add Opensis to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-41691 | 9.8 | Jun 24 | A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to… Affected: 8.0 |
| CVE-2025-22930 | 9.8 | Apr 3 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php Affected: 7.0 through 9.1 |
| CVE-2025-22928 | 9.8 | Apr 3 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php Affected: 7.0 through 9.1 |
| CVE-2025-22926 | 9.8 | Apr 3 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to… Affected: 8.0 through 9.1 |
| CVE-2025-22929 | 9.8 | Apr 3 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php Affected: 7.0 through 9.1 |
| CVE-2024-51211 | 9.8 | Nov 8 | SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file Affected: 9.0; 9.1 |
| CVE-2023-38880 | 9.8 | Nov 20 | The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality Affected: 9.0 |
| CVE-2021-41679 | 9.8 | Nov 30 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database Affected: 8.0 |
| CVE-2021-41678 | 9.8 | Nov 30 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database Affected: 8.0 |
| CVE-2021-41677 | 9.8 | Nov 30 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database Affected: 8.0 |
| CVE-2021-40618 | 9.8 | Oct 12 | An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in… Affected: 8.0 |
| CVE-2021-40617 | 9.8 | Oct 11 | An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php Affected: 8.0 |
| CVE-2021-40543 | 9.8 | Oct 11 | Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET['usrid'] and $_GET['prof_id'] in the… Affected: 8.0 |
| CVE-2021-27341 | 9.8 | Sep 16 | OpenSIS Community Edition version <= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parameter Affected: through 7.6 |
| CVE-2021-39379 | 9.8 | Sep 1 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database Affected: 8.0 |
| CVE-2021-39378 | 9.8 | Sep 1 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database Affected: 8.0 |
| CVE-2021-39377 | 9.8 | Sep 1 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database Affected: 8.0 |
| CVE-2021-40353 | 9.8 | Sep 1 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database Affected: 8.0 |
| CVE-2020-6144 | 9.8 | Sep 1 | A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4 Affected: 7.4 |
| CVE-2020-6143 | 9.8 | Sep 1 | A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4 Affected: 7.4 |
| CVE-2020-6142 | 9.8 | Sep 1 | A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6140 | 9.8 | Sep 1 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6139 | 9.8 | Sep 1 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6138 | 9.8 | Sep 1 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6137 | 9.8 | Sep 1 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6141 | 9.8 | Sep 1 | An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6637 | 9.8 | Aug 24 | openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php Affected: 7.3 |
| CVE-2020-13381 | 9.8 | Jul 1 | openSIS through 7.4 allows SQL Injection Affected: through 7.4 |
| CVE-2020-13380 | 9.8 | Jul 1 | openSIS before 7.4 allows SQL Injection Affected: through 7.4 |
| CVE-2025-22927 | 9.1 | Apr 3 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to… Affected: 8.0 through 9.1 |
| CVE-2020-13382 | 9.1 | Jul 1 | openSIS through 7.4 has Incorrect Access Control Affected: through 7.4 |
| CVE-2025-22924 | 8.8 | Apr 2 | OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php Affected: 7.0 through 9.1 |
| CVE-2025-22923 | 8.8 | Apr 2 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to… Affected: 8.0 through 9.1 |
| CVE-2024-35584 | 8.8 | Oct 15 | SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and… Affected: 8.0; 9.1 |
| CVE-2024-46626 | 8.8 | Oct 2 | OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload Affected: 9.1 |
| CVE-2023-38885 | 8.8 | Nov 20 | OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app Affected: 9.0 |
| CVE-2021-40309 | 8.8 | Sep 24 | A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0 Affected: 8.0 |
| CVE-2020-6136 | 8.8 | Sep 1 | An exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6135 | 8.8 | Sep 1 | An exploitable SQL injection vulnerability exists in the Validator.php functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6134 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages Affected: 7.3 |
| CVE-2020-6133 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages Affected: 7.3 |
| CVE-2020-6132 | 8.8 | Sep 1 | SQL injection vulnerability exists in the ID parameters of OS4Ed openSIS 7.3 pages Affected: 7.3 |
| CVE-2020-6128 | 8.8 | Sep 1 | SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6127 | 8.8 | Sep 1 | SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6126 | 8.8 | Sep 1 | SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6125 | 8.8 | Sep 1 | An exploitable SQL injection vulnerability exists in the GetSchool.php functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6124 | 8.8 | Sep 1 | An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6131 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages Affected: 7.3 |
| CVE-2020-6130 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages Affected: 7.3 |
| CVE-2020-6129 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages Affected: 7.3 |