Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
opensis vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2020-6144
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trig...
Os4ed Opensis 7.4
9.8
CVSSv3
CVE-2021-39377
A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands to the MySQL (MariaDB) database through the index.php username parameter.
Os4ed Opensis 8.0
1 Github repository
9.8
CVSSv3
CVE-2021-39378
A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands to the MySQL (MariaDB) database through the NamesList.php str parameter.
Os4ed Opensis 8.0
1 Github repository
9.8
CVSSv3
CVE-2021-39379
A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands to the MySQL (MariaDB) database through the ResetUserInfo.php password_stn_id parameter.
Os4ed Opensis 8.0
1 Github repository
7.5
CVSSv3
CVE-2022-27041
Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases.
Os4ed Opensis 8.0
7.5
CVSSv3
CVE-2023-38879
The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote malicious users to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'.
Os4ed Opensis 9.0
9.8
CVSSv3
CVE-2023-38880
The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin generates a database backup, the backup is stored in the web root while the file name has a format of "opensisB...
Os4ed Opensis 9.0
6.1
CVSSv3
CVE-2023-38881
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote malicious users to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the 'calendar_id...
Os4ed Opensis 9.0
6.1
CVSSv3
CVE-2023-38882
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote malicious users to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' para...
Os4ed Opensis 9.0
6.1
CVSSv3
CVE-2023-38883
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote malicious users to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' paramet...
Os4ed Opensis 9.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
NULL pointer dereference
CVE-2023-52689
CVE-2024-23803
client side
CVE-2023-52696
information disclosure
CVE-2024-35843
CVE-2024-27130
CVE-2023-52697
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »