Os4ed vulnerabilities
We track 13 vulnerabilities in Os4ed products across 2 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on October 5, 2026.
Latest Os4ed vulnerabilities
- 9.3 Critical severity
openSIS-Classic: Authorization Bypass Through User-Controlled Key
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
- 7.1 High severity
openSIS-Classic: Authorization Bypass Through User-Controlled Key
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary ma
- 8.1 High severity
Opensis: Improper Access Control
OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized database write operations relating to the data of other users.
- 7.5 High severity
Opensis: Authorization Bypass Through User-Controlled Key
An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff members.
- 9.8 Critical severity
Opensis: Improper Limitation of a Pathname to a Restricted Directory
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.
- 9.1 Critical severity
Opensis: Improper Limitation of a Pathname to a Restricted Directory
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.
- 7.5 High severity
Opensis: Improper Neutralization of Special Elements used in an SQL Command
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php. The remote, authenticated attacker requires the admin role to successfully exploit this vulnerability.
- 8.8 High severity
Opensis: Improper Limitation of a Pathname to a Restricted Directory
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile.
- 9.8 Critical severity
opensis-classic: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbi
- 8.8 High severity
Opensis: Cross-Site Request Forgery
OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request.
- 7.5 High severity
Opensis: Authorization Bypass Through User-Controlled Key
An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/<studentId>-<filename>'
- 7.5 High severity
Opensis: Improper Limitation of a Pathname to a Restricted Directory
The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'.
- 7.5 High severity
Opensis: Improper Neutralization of Special Elements used in an SQL Command
Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases.