OP
Product
Opensis
81
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 31High 37Medium 11Low 0
Watch
Add Opensis to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-6123 | 8.8 | Sep 1 | An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6122 | 8.8 | Sep 1 | SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6121 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6120 | 8.8 | Sep 1 | SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6119 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6118 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6117 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2025-65594 | 8.1 | Dec 9 | OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized database write operations… Affected: through 9.2 |
| CVE-2025-26186 | 8.1 | Jul 15 | SQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.php Affected: 9.1 |
| CVE-2025-22931 | 7.5 | Apr 3 | An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff… Affected: 7.0 through 9.1 |
| CVE-2025-22925 | 7.5 | Apr 2 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php Affected: 7.0 through 9.1 |
| CVE-2023-38884 | 7.5 | Nov 20 | An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's… Affected: 9.0 |
| CVE-2023-38879 | 7.5 | Nov 20 | The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of… Affected: 9.0 |
| CVE-2022-27041 | 7.5 | Apr 11 | Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases Affected: 8.0 |
| CVE-2021-40636 | 7.5 | Mar 3 | OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database Affected: 8.0 |
| CVE-2021-40635 | 7.5 | Mar 3 | OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php Affected: 8.0 |
| CVE-2020-27408 | 7.5 | Dec 4 | OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of… Affected: through 7.6 |
| CVE-2020-13383 | 7.5 | Jul 1 | openSIS through 7.4 allows Directory Traversal Affected: through 7.4 |
| CVE-2026-11944 | 6.5 | Jul 14 | openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download Affected: 9.3 |
| CVE-2022-45962 | 6.5 | Feb 13 | Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php Affected: through 8.0 |
| CVE-2021-40651 | 6.5 | Sep 29 | OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's… Affected: 8.0 |
| CVE-2023-38883 | 6.1 | Nov 20 | A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the… Affected: 9.0 |
| CVE-2023-38882 | 6.1 | Nov 20 | A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the… Affected: 9.0 |
| CVE-2023-38881 | 6.1 | Nov 20 | A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the… Affected: 9.0 |
| CVE-2021-40637 | 6.1 | Mar 3 | OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) in EmailCheckOthers.php Affected: 8.0 |
| CVE-2021-40542 | 6.1 | Oct 11 | Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS) Affected: 8.0 |
| CVE-2021-27340 | 6.1 | Sep 16 | OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter Affected: through 7.6 |
| CVE-2020-27409 | 6.1 | Dec 4 | OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter Affected: before 7.5 |
| CVE-2021-40310 | 5.4 | Sep 24 | OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss_attn parameter Affected: 8.0 |
| CVE-2014-8366 | – | Oct 20 | SQL injection vulnerability in openSIS 4.5 through 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php Affected: 4.5; 5.3 |
| CVE-2013-1349 | – | Dec 9 | Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter Affected: 4.5; 4.6; 4.7; 4.8; 4.8.1; 4.9; +3 more |