CVE-2026-103113
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In OS4ED openSIS-Classic up to version 9.3, the save action function in modules/students/Student.php (General Information Tab component) is vulnerable to SQL injection via manipulation of the students argument. The attack can be performed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed but has not responded.
Risk Assessment
An attacker can remotely execute unauthorized SQL queries, potentially leading to data leakage, database modification, or full system compromise.
Recommendation
Immediately update openSIS-Classic to the latest version if available, or apply temporary mitigations such as input validation and parameterized queries. Monitor logs for suspicious activity.
Other vulnerabilities in openSIS-Classic
See all- CVE-2026-91107Critical
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role to select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
- CVE-2026-11944Medium
A path traversal vulnerability in the legacy messaging sent-mail attachment download functionality of openSIS Classic 9.3 allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.
Original NVD description (English source)
A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argument students can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS