Login Request a demo
OS
Vendor
Os4ed
2 products with CVEs on record
90
CVEs
0
On KEV
6
New 30D
Products
OP
openSIS-Classic
OS4ED
9.8
9 CVEs0 on KEV6 new
OP
Opensis
Os4ed
9.8
81 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-91107
OP
openSIS-Classic
OS4ED
9.3
0%
Oct 5openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)
CVE-2026-103117
OP
openSIS-Classic
OS4ED
4.7
0%
Sep 30OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection
CVE-2026-103116
OP
openSIS-Classic
OS4ED
6.3
0%
Sep 30OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection
CVE-2026-103115
OP
openSIS-Classic
OS4ED
6.3
0%
Sep 30OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection
CVE-2026-103114
OP
openSIS-Classic
OS4ED
6.3
0%
Sep 30OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection
CVE-2026-103113
OP
openSIS-Classic
OS4ED
4.7
0%
Sep 30OS4ED openSIS-Classic General Information Tab Student.php save action sql injection
CVE-2026-11944
OP
openSIS-Classic
OS4ED
6.5
0%
Jul 14openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download
CVE-2026-8406
OP
openSIS-Classic
OS4ED
7.1
0%
Jun 11openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail
CVE-2025-65594
OP
Opensis
Os4ed
8.1
0%
Dec 9OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized database write operations…
CVE-2025-26186
OP
Opensis
Os4ed
8.1
1%
Jul 15SQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.php
CVE-2021-41691
OP
Opensis
Os4ed
9.8
2%
Jun 24A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to…
CVE-2025-22930
OP
Opensis
Os4ed
9.8
1%
Apr 3OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php
CVE-2025-22931
OP
Opensis
Os4ed
7.5
0%
Apr 3An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff…
CVE-2025-22929
OP
Opensis
Os4ed
9.8
1%
Apr 3OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php
CVE-2025-22926
OP
Opensis
Os4ed
9.8
1%
Apr 3An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to…
CVE-2025-22928
OP
Opensis
Os4ed
9.8
0%
Apr 3OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php
CVE-2025-22927
OP
Opensis
Os4ed
9.1
1%
Apr 3An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to…
CVE-2025-22925
OP
Opensis
Os4ed
7.5
0%
Apr 2OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php
CVE-2025-22924
OP
Opensis
Os4ed
8.8
0%
Apr 2OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php
CVE-2025-22923
OP
Opensis
Os4ed
8.8
1%
Apr 2An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to…
CVE-2024-51211
OP
Opensis
Os4ed
9.8
2%
Nov 8SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file
CVE-2024-35584
OP
Opensis
Os4ed
8.8
6%
Oct 15SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and…
CVE-2024-46626
OP
Opensis
Os4ed
8.8
1%
Oct 2OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload
CVE-2023-38885
OP
Opensis
Os4ed
8.8
0%
Nov 20OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app
CVE-2023-38884
OP
Opensis
Os4ed
7.5
1%
Nov 20An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's…
CVE-2023-38883
OP
Opensis
Os4ed
6.1
1%
Nov 20A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the…
CVE-2023-38882
OP
Opensis
Os4ed
6.1
1%
Nov 20A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the…
CVE-2023-38881
OP
Opensis
Os4ed
6.1
1%
Nov 20A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the…
CVE-2023-38880
OP
Opensis
Os4ed
9.8
1%
Nov 20The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality
CVE-2023-38879
OP
Opensis
Os4ed
7.5
4%
Nov 20The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of…
CVE-2022-45962
OP
Opensis
Os4ed
6.5
1%
Feb 13Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php
CVE-2022-27041
OP
Opensis
Os4ed
7.5
1%
Apr 11Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases
CVE-2021-40637
OP
Opensis
Os4ed
6.1
1%
Mar 3OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) in EmailCheckOthers.php
CVE-2021-40636
OP
Opensis
Os4ed
7.5
1%
Mar 3OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database
CVE-2021-40635
OP
Opensis
Os4ed
7.5
1%
Mar 3OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php
CVE-2021-41679
OP
Opensis
Os4ed
9.8
1%
Nov 30A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database
CVE-2021-41678
OP
Opensis
Os4ed
9.8
1%
Nov 30A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database
CVE-2021-41677
OP
Opensis
Os4ed
9.8
1%
Nov 30A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database
CVE-2021-40618
OP
Opensis
Os4ed
9.8
1%
Oct 12An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in…
CVE-2021-40617
OP
Opensis
Os4ed
9.8
5%
Oct 11An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php
CVE-2021-40543
OP
Opensis
Os4ed
9.8
1%
Oct 11Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET['usrid'] and $_GET['prof_id'] in the…
CVE-2021-40542
OP
Opensis
Os4ed
6.1
3%
Oct 11Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS)
CVE-2021-40651
OP
Opensis
Os4ed
6.5
18%
Sep 29OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's…
CVE-2021-40310
OP
Opensis
Os4ed
5.4
1%
Sep 24OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss_attn parameter
CVE-2021-40309
OP
Opensis
Os4ed
8.8
2%
Sep 24A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0
CVE-2021-27341
OP
Opensis
Os4ed
9.8
2%
Sep 16OpenSIS Community Edition version <= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parameter
CVE-2021-27340
OP
Opensis
Os4ed
6.1
1%
Sep 16OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter
CVE-2021-39379
OP
Opensis
Os4ed
9.8
4%
Sep 1A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database
CVE-2021-39378
OP
Opensis
Os4ed
9.8
23%
Sep 1A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database
CVE-2021-39377
OP
Opensis
Os4ed
9.8
4%
Sep 1A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database
CVE-2021-40353
OP
Opensis
Os4ed
9.8
3%
Sep 1A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database
CVE-2020-27409
OP
Opensis
Os4ed
6.1
1%
Dec 4OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter
CVE-2020-27408
OP
Opensis
Os4ed
7.5
2%
Dec 4OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of…
CVE-2020-6144
OP
Opensis
Os4ed
9.8
6%
Sep 1A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4
CVE-2020-6143
OP
Opensis
Os4ed
9.8
6%
Sep 1A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4
CVE-2020-6142
OP
Opensis
Os4ed
9.8
9%
Sep 1A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3
CVE-2020-6140
OP
Opensis
Os4ed
9.8
3%
Sep 1SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3
CVE-2020-6139
OP
Opensis
Os4ed
9.8
3%
Sep 1SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3
CVE-2020-6138
OP
Opensis
Os4ed
9.8
3%
Sep 1SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3
CVE-2020-6137
OP
Opensis
Os4ed
9.8
3%
Sep 1SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3