CVE-2026-103114
MediumCVSS 6.3Summary
SQL injection vulnerability in OS4ED openSIS-Classic up to 9.3. The function DBQuery_assignment in file modules/grades/Assignments.php (component Assignment Management Endpoint) allows manipulation of the argument Tables, enabling remote attack. Exploit is publicly available.
Risk Assessment
Risk of unauthorized database access, data theft or modification, and potential system compromise.
Recommendation
Apply vendor patches or restrict access to the component if no patch is available.
Other vulnerabilities in OS4ED openSIS-Classic
See all- CVE-2026-103117Medium
SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. The db_properties function in functions/DatabaseInc.php of the Save Data Handler component allows manipulation of the values argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-103116Medium
SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. The DBQuery function in functions/GetStuListFnc.php of the Student List Search Endpoint component allows manipulation of the LO_sort argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-103115Medium
SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. An unknown function in functions/CustomFieldsFnc.php of the Student Search component allows manipulation of the cust argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS