CVE-2025-65236

CriticalCVSS 9.8

Published: 26/11/2025(UTC)Updated: 04/11/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

42th percentile - higher than 42% of all known CVEs

Summary

OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint.

Risk Assessment

An attacker could exploit this vulnerability to manipulate the database, potentially leading to data disclosure, modification, or deletion.

Recommendation

Update OpenCode Systems USSD Gateway to the latest version. Use parameterized SQL queries and input validation.

Other vulnerabilities in OpenCode Systems USSD Gateway

CVE-2025-65235Critical
OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function.

Original NVD description (English source)

OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS