OP
Product
Opensis
81
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 31High 37Medium 11Low 0
Watch
Add Opensis to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-22924 | 8.8 | Apr 2 | OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php Affected: 7.0 through 9.1 |
| CVE-2025-22923 | 8.8 | Apr 2 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to… Affected: 8.0 through 9.1 |
| CVE-2024-35584 | 8.8 | Oct 15 | SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and… Affected: 8.0; 9.1 |
| CVE-2024-46626 | 8.8 | Oct 2 | OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload Affected: 9.1 |
| CVE-2023-38885 | 8.8 | Nov 20 | OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app Affected: 9.0 |
| CVE-2021-40309 | 8.8 | Sep 24 | A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0 Affected: 8.0 |
| CVE-2020-6136 | 8.8 | Sep 1 | An exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6135 | 8.8 | Sep 1 | An exploitable SQL injection vulnerability exists in the Validator.php functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6134 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages Affected: 7.3 |
| CVE-2020-6133 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages Affected: 7.3 |
| CVE-2020-6132 | 8.8 | Sep 1 | SQL injection vulnerability exists in the ID parameters of OS4Ed openSIS 7.3 pages Affected: 7.3 |
| CVE-2020-6128 | 8.8 | Sep 1 | SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6127 | 8.8 | Sep 1 | SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6126 | 8.8 | Sep 1 | SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6125 | 8.8 | Sep 1 | An exploitable SQL injection vulnerability exists in the GetSchool.php functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6124 | 8.8 | Sep 1 | An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6131 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages Affected: 7.3 |
| CVE-2020-6130 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages Affected: 7.3 |
| CVE-2020-6129 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages Affected: 7.3 |
| CVE-2020-6123 | 8.8 | Sep 1 | An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6122 | 8.8 | Sep 1 | SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6121 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6120 | 8.8 | Sep 1 | SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6119 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6118 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2020-6117 | 8.8 | Sep 1 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3 Affected: 7.3 |
| CVE-2025-65594 | 8.1 | Dec 9 | OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized database write operations… Affected: through 9.2 |
| CVE-2025-26186 | 8.1 | Jul 15 | SQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.php Affected: 9.1 |
| CVE-2025-22931 | 7.5 | Apr 3 | An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff… Affected: 7.0 through 9.1 |
| CVE-2025-22925 | 7.5 | Apr 2 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php Affected: 7.0 through 9.1 |
| CVE-2023-38879 | 7.5 | Nov 20 | The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of… Affected: 9.0 |
| CVE-2023-38884 | 7.5 | Nov 20 | An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's… Affected: 9.0 |
| CVE-2022-27041 | 7.5 | Apr 11 | Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases Affected: 8.0 |
| CVE-2021-40636 | 7.5 | Mar 3 | OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database Affected: 8.0 |
| CVE-2021-40635 | 7.5 | Mar 3 | OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php Affected: 8.0 |
| CVE-2020-27408 | 7.5 | Dec 4 | OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of… Affected: through 7.6 |
| CVE-2020-13383 | 7.5 | Jul 1 | openSIS through 7.4 allows Directory Traversal Affected: through 7.4 |
Showing 37