CVE-2026-103113

OS4ED openSIS-Classic General Information Tab Student.php save action sql injection

A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argument students can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Affected

OS4ED · openSIS-Classic

CVSS v4.0 VULDB

2.0 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULDB

4.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0 VULDB

5.8 MEDIUMAV:N/AC:L/Au:M/C:P/I:P/A:P

EPSS

0.33% chance of exploitation in the next 30 days, 25th percentile

Published

2026-09-30

Updated

2026-10-01

Proof-of-concept exploits (1)

• OS4ED/openSIS-Classic/issues/475345★ · 2026-10-05

References

• CVE Record
• NVD entry

Related

• CVE-2021-40542
• CVE-2021-40543
• CVE-2021-40617
• CVE-2021-40618
• CVE-2021-40635
• CVE-2021-40636