Open-School 2.2 Community Edition

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:open-school:open-school:2.2:*:*:*:community:*:*:*

part: a version: 2.2 update: *

VendorOpen School (373acf75-a8d0-5121-8d48-9e594a3dd135)
ProductOpen School (167b9209-319d-5cac-9c6a-63a137dbc78a)
Edition*
Language*
Software editioncommunity
Target software*
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:docker/plutonyx/open-school-ce purl2cpe 2026-06-01 10:15:00.331123
pkg:github/traprajith/open-school-ce purl2cpe 2026-06-01 10:15:00.331125

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2014-9127 vulnerable 2026-06-08 05:06:10.921226 Details available
Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php.
Published: 2020-02-08T16:36:53.000Z
Updated: 2024-08-06T13:33:13.518Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2014-9126 vulnerable 2026-06-08 05:06:10.920819 Details available
Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YII_CSRF_TOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php.
Published: 2020-02-08T16:23:29.000Z
Updated: 2024-08-06T13:33:13.633Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.