Skip to content
Noroxi

open-school records

5 published records for vendor open-school.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

5 records
  • CVE-2019-14754
    39Monitor

    Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter.

    CriticalCVSS 9.8No exploitEPSS 2%

    open-school · open-schoolAug 8, 2019

  • CVE-2009-4208
    30Monitor

    SQL injection vulnerability in the os_news module in Open-school (OS) 1.0 allows remote attackers to execute arbitrary SQL commands via the

    HighCVSS 7.5Proof of conceptEPSS 1%

    open-school · open-schoolDec 4, 2009

  • CVE-2019-14696
    29Monitor

    Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.

    MediumCVSS 6.1Proof of conceptEPSS 16%

    open-school · open-schoolAug 6, 2019

  • CVE-2014-9127
    26Monitor

    Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to

    MediumCVSS 6.5No exploitEPSS 1%

    open-school · open-schoolFeb 8, 2020

  • CVE-2014-9126
    24Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web scri

    MediumCVSS 6.1No exploitEPSS 1%

    open-school · open-schoolFeb 8, 2020