Vulnerabilidades do OS4ED openSIS-Classic

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam OS4ED openSIS-Classic: 3 registro(s), com versões afetadas e correções.

CVE-2026-91107 Crítica · 9.3 CWE-639 05/10/2026

openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.

CVE-2026-11944 Média · 6.5 CWE-22 14/07/2026

openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download

openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.

CVE-2026-8406 Alta · 7.1 CWE-639 11/06/2026

openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.