CVE-2026-103115
OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection
Description
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
INFO
Published Date :
Sept. 30, 2026, 12:15 p.m.
Last Modified :
Sept. 30, 2026, 12:15 p.m.
Remotely Exploit :
No
Source :
VulDB
Solution
- Update OS4ED openSIS-Classic to the latest version.
- Validate and sanitize all user inputs.
- Apply vendor security patches when available.
- Review input validation for CustomFieldsFnc.php.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-103115 vulnerability anywhere in the article.