Skip to content
Noroxi

OS4ED records

81 published records for vendor os4ed.

Researcher profile

Entered KEV
0 · 0%
Weaponized
4 · 4.9%
Pre-auth RCE
9
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 20
  2. 21
  3. 22
  4. 23
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

81 records
  • CVE-2020-13381
    57Plan

    openSIS through 7.4 allows SQL Injection.

    CriticalCVSS 9.8WeaponizedEPSS 59%

    os4ed · opensisJul 1, 2020

  • CVE-2020-13382
    52Plan

    openSIS through 7.4 has Incorrect Access Control.

    CriticalCVSS 9.1WeaponizedEPSS 53%

    os4ed · opensisJul 1, 2020

  • CVE-2020-13383
    50Plan

    openSIS through 7.4 allows Directory Traversal.

    HighCVSS 7.5WeaponizedEPSS 68%

    os4ed · opensisJul 1, 2020

  • CVE-2021-39378
    46Plan

    A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database.

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    os4ed · opensisSep 1, 2021

  • CVE-2020-6637
    45Plan

    openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    os4ed · opensisAug 24, 2020

  • CVE-2020-6142
    42Plan

    A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3.

    CriticalCVSS 9.8No exploitEPSS 9%

    os4ed · opensisSep 1, 2020

  • CVE-2020-6144
    41Plan

    A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4.

    CriticalCVSS 9.8No exploitEPSS 6%

    os4ed · opensisSep 1, 2020

  • CVE-2020-6143
    41Plan

    A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4.

    CriticalCVSS 9.8No exploitEPSS 6%

    os4ed · opensisSep 1, 2020

  • CVE-2021-40617
    41Plan

    An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php.

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    os4ed · opensisOct 11, 2021

  • CVE-2020-6141
    40Plan

    An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3.

    CriticalCVSS 9.8No exploitEPSS 4%

    os4ed · opensisSep 1, 2020

  • CVE-2021-39379
    40Plan

    A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database.

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    os4ed · opensisSep 1, 2021

  • CVE-2021-39377
    40Plan

    A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database.

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    os4ed · opensisSep 1, 2021

  • CVE-2021-40353
    40Plan

    A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    os4ed · opensisAug 31, 2021

  • CVE-2020-6140
    40Plan

    SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3.

    CriticalCVSS 9.8No exploitEPSS 3%

    os4ed · opensisSep 1, 2020

  • CVE-2020-6137
    40Plan

    SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3.

    CriticalCVSS 9.8No exploitEPSS 3%

    os4ed · opensisSep 1, 2020

  • CVE-2020-6138
    40Plan

    SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3.

    CriticalCVSS 9.8No exploitEPSS 3%

    os4ed · opensisSep 1, 2020

  • CVE-2020-6139
    40Plan

    SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3.

    CriticalCVSS 9.8No exploitEPSS 3%

    os4ed · opensisSep 1, 2020

  • CVE-2020-13380
    40Plan

    openSIS before 7.4 allows SQL Injection.

    CriticalCVSS 9.8No exploitEPSS 2%

    os4ed · opensisJul 1, 2020

  • CVE-2024-51211
    40Plan

    SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file.

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    os4ed · opensisNov 8, 2024

  • CVE-2021-27341
    40Plan

    OpenSIS Community Edition version <= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parame

    CriticalCVSS 9.8No exploitEPSS 2%

    os4ed · opensisSep 16, 2021

  • CVE-2021-41691
    40Plan

    A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" para

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    os4ed · opensisJun 24, 2025

  • CVE-2021-40618
    39Monitor

    An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT

    CriticalCVSS 9.8No exploitEPSS 1%

    os4ed · opensisOct 12, 2021

  • CVE-2021-41677
    39Monitor

    A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.

    CriticalCVSS 9.8No exploitEPSS 1%

    os4ed · opensisNov 30, 2021

  • CVE-2021-41678
    39Monitor

    A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.

    CriticalCVSS 9.8No exploitEPSS 1%

    os4ed · opensisNov 30, 2021

  • CVE-2021-41679
    39Monitor

    A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.

    CriticalCVSS 9.8No exploitEPSS 1%

    os4ed · opensisNov 30, 2021