CVE-2025-65594

HighCVSS 8.1

Published: 09/12/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

OpenSIS version 9.2 and below is vulnerable to Incorrect Access Control in Student.php, allowing an authenticated low-privilege user to perform unauthorized database write operations on other users' data.

Risk Assessment

The risk involves unauthorized modification of other users' data by a low-privilege user, potentially leading to data integrity issues, privilege escalation, or information disclosure.

Recommendation

It is recommended to immediately update OpenSIS to the latest available version that fixes this vulnerability. Until then, restrict access to Student.php and implement additional access control mechanisms.

Other vulnerabilities in OpenSIS

CVE-2014-8366High
SQL injection vulnerability in openSIS from version 4.5 to 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php.

Original NVD description (English source)

OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized database write operations relating to the data of other users.