GCVE - cpe:2.3:a:os4ed:opensis:8.0:*:*:*:community:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:os4ed:opensis:8.0:*:*:*:community:*:*:*

part: a version: 8.0 update: *

Vendor	Os4Ed (`6cbf6094-577e-5750-94b1-eb009ed7d213`)
Product	Opensis (`0102caef-70bb-54b8-8259-c29cfbe58261`)
Edition	*
Language	*
Software edition	community
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/os4ed/opensis-classic`	purl2cpe	2026-06-01 10:13:28.382805

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-35584`	vulnerable	2026-06-08 06:39:42.154173	Details available SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from "X-Forwarded-For" header and appends it to a SQL INSERT statement directly, leading to SQL Injection. Published: 2024-10-15T00:00:00.000Z Updated: 2026-07-05T16:04:13.492Z Open on db.gcve.eu Reference links https://github.com/whwhwh96/CVE-2024-35584	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-41691`	vulnerable	2026-06-08 05:35:20.887592	Details available A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to /TransferredOutModal.php. Published: 2025-06-24T00:00:00.000Z Updated: 2025-06-25T14:34:52.796Z Open on db.gcve.eu Reference links https://opensis.com/ https://github.com/OS4ED/openSIS-Classic/ https://resources.s4e.io/blog/opensis-student-information-system-0-day-vulnerability-cve-2021-41691/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40651`	vulnerable	2026-06-08 05:35:18.855357	Details available OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file. Published: 2021-09-29T11:59:07.000Z Updated: 2024-08-04T02:51:06.297Z Open on db.gcve.eu Reference links https://youtu.be/wFwlbXANRCo https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md https://www.exploit-db.com/exploits/50259	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40618`	vulnerable	2026-06-08 05:35:18.838844	Details available An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in HoldAddressFields.php. Published: 2021-10-12T17:39:55.000Z Updated: 2024-08-04T02:44:10.798Z Open on db.gcve.eu Reference links https://github.com/OS4ED/openSIS-Classic/issues/193	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40617`	vulnerable	2026-06-08 05:35:18.838544	Details available An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php. Published: 2021-10-11T18:28:50.000Z Updated: 2025-04-16T14:11:19.679Z Open on db.gcve.eu Reference links https://github.com/OS4ED/openSIS-Classic/issues/192 https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2021-40617.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40310`	vulnerable	2026-06-08 05:35:17.391857	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40309`	vulnerable	2026-06-08 05:35:17.391337	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.