GCVE - cpe:2.3:a:osclass:osclass:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:osclass:osclass:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Osclass (`1aca265f-644f-599c-b4a7-da058a60f3a4`)
Product	Osclass (`76376e23-eb1c-541e-8d4c-8406679de9dd`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/ricktaylord/osclass`	purl2cpe	2026-06-01 10:11:40.075144
`pkg:docker/bitnami/osclass`	purl2cpe	2026-06-01 10:11:40.075147
`pkg:github/mindstellar/osclass`	purl2cpe	2026-06-01 10:11:40.075150
`pkg:github/osclass/osclass`	purl2cpe	2026-06-01 10:11:40.075156
`pkg:npm/%40helm-charts/bitnami-osclass`	purl2cpe	2026-06-01 10:11:40.075159
`pkg:sourceforge/osclass`	purl2cpe	2026-06-01 10:11:40.075161

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-113381`	vulnerable	2026-11-03 10:16:27.127104	Osclass Item Model Item.php findUserItems sql injection HIGH (7.3) A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2026-10-20T09:45:06.205Z Updated: 2026-10-20T13:28:23.121Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/422654 https://vuldb.com/vuln/422654/cti https://vuldb.com/cve/CVE-2026-113381 https://vuldb.com/submit/990500	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8085`	vulnerable	2026-06-08 05:06:07.220540	Details available Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory. Published: 2015-01-05T20:00:00.000Z Updated: 2024-08-06T13:10:50.627Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/129777/Osclass-3.4.2-Shell-Upload.html http://www.securityfocus.com/bid/71842 http://karmainsecurity.com/KIS-2014-16 http://blog.osclass.org/2014/10/09/osclass-3-4-3-ready-download/ http://www.securityfocus.com/archive/1/534361/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8084`	vulnerable	2026-06-08 05:06:07.220186	Details available Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ajaxfile parameter in a custom action. Published: 2015-01-05T20:00:00.000Z Updated: 2024-08-06T13:10:50.596Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/534360/100/0/threaded http://www.securityfocus.com/bid/71841 http://karmainsecurity.com/KIS-2014-15 http://blog.osclass.org/2014/10/09/osclass-3-4-3-ready-download/ http://packetstormsecurity.com/files/129776/Osclass-3.4.2-Local-File-Inclusion.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8083`	vulnerable	2026-06-08 05:06:07.219738	Details available SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action. Published: 2015-01-05T20:00:00.000Z Updated: 2024-08-06T13:10:49.957Z Open on db.gcve.eu Reference links http://karmainsecurity.com/KIS-2014-14 http://seclists.org/fulldisclosure/2014/Dec/132 http://blog.osclass.org/2014/10/09/osclass-3-4-3-ready-download/ http://www.securityfocus.com/archive/1/534359/100/0/threaded http://www.securityfocus.com/bid/71840	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6308`	vulnerable	2026-06-08 05:05:57.387404	Details available Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php. Published: 2014-10-20T14:00:00.000Z Updated: 2024-08-06T12:10:13.294Z Open on db.gcve.eu Reference links http://blog.osclass.org/2014/09/15/osclass-3-4-2-ready-download/ http://packetstormsecurity.com/files/128285/OsClass-3.4.1-Local-File-Inclusion.html https://www.netsparker.com/lfi-vulnerability-in-osclass/ https://github.com/osclass/Osclass/commit/c163bf5910d0d36424d7fc678da6b03a0e443435 http://www.securityfocus.com/archive/1/533456/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6280`	vulnerable	2026-06-08 05:05:57.314315	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5163`	vulnerable	2026-06-08 05:02:54.865830	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5162`	vulnerable	2026-06-08 05:02:54.865404	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-0973`	vulnerable	2026-06-08 05:00:46.758072	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Osclass

Notes

PURL mappings

Vulnerability references

Contribute