CVE-2026-113381
HighCVSS 7.3Summary
A weakness has been identified in Osclass up to 8.3.1. Affected is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the Item Model Handler component. Manipulation of the sPattern argument causes SQL injection. The attack may be initiated remotely and the exploit has been made public. The vendor was contacted early but did not respond.
Risk Assessment
A remote attacker may use the publicly available exploit for SQL injection to read or modify database data.
Recommendation
Restrict access to the application, apply patches or mitigations (validate the sPattern parameter) and monitor for exploitation attempts.
Other vulnerabilities in Osclass
See all- CVE-2014-8084High
CVE-2014-8084 in OSClass before version 3.4.3 has a directory traversal vulnerability that allows remote attackers to include and execute arbitrary local files.
- CVE-2014-8083High
SQL injection vulnerability in the Search::setJsonAlert method in OSClass before version 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action.
Original NVD description (English source)
A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS