Vulnerabilidades de Os4ed
CVEs publicadas que afetam produtos de Os4ed: 4 registro(s), com severidade, exploração e correções.
CVE-2026-91107
Crítica · 9.3
CWE-639 05/10/2026
openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
CVE-2026-11944
Média · 6.5
CWE-22 14/07/2026
Path Traversal em Os4ed Opensis
openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.
CVE-2026-8406
Alta · 7.1
CWE-639 11/06/2026
openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.
CVE-2025-65594
Alta · 8.1
CWE-284 09/12/2025
Improper Access Control em Os4ed Opensis
OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized database write operations relating to the data of other users.