CVE-2021-41691
CRITICAL EXPLOITED NUCLEIOS4Ed OpenSIS Community 8.0 - SQL Injection via Student ID and TRANSFER{SCHOOL} Parameters
Title source: llmExploitation Summary
CVE-2021-41691 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.
Description
A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to /TransferredOutModal.php.
Nuclei Templates (1)
openSIS Student Information System 8.0 SQL Injection
HIGHby Bartu Utku SARP
References (3)
Core 3
Core References
Product
https://opensis.com/
Scores
CVSS v3
9.8
EPSS
0.0172
EPSS Percentile
74.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
VulnCheck KEV
2025-06-26
CWE
CWE-89
Status
published
Products (1)
os4ed/opensis
8.0
Published
Jun 24, 2025
Tracked Since
Feb 18, 2026