Vulnerabilidades de Opencode
CVEs publicadas que afetam produtos de Opencode: 6 registro(s), com severidade, exploração e correções.
CVE-2025-70614
Alta · 8.1
CWE-284 05/03/2026
Improper Access Control em Opencode Ussd Gateway
OpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 contains a broken access control vulnerability in the web-based control panel allowing authenticated low-privileged attackers to gain to access to arbitrary SMS messages via a crafted company or tenant identifier parameter.
CVE-2025-65239
Média · 4.3
CWE-284 26/11/2025
Improper Access Control em Opencode Ussd Gateway
Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level privileges to read server logs.
CVE-2025-65238
Média · 6.5
CWE-284 26/11/2025
Improper Access Control em Opencode Ussd Gateway
Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level privileges to dump user records and access sensitive information.
CVE-2025-65237
Média · 6.1
CWE-79 26/11/2025
Cross-site Scripting (XSS) em Opencode Ussd Gateway
A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload.
CVE-2025-65236
Crítica · 9.8
CWE-89 26/11/2025
SQL Injection em Opencode Ussd Gateway
OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint.
CVE-2025-65235
Crítica · 9.8
CWE-89 26/11/2025
SQL Injection em Opencode Ussd Gateway
OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function.