CVE-2021-40651
6.5 MEDIUMOS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose ...
Published: 2021-09-29 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 6.5 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CWE
- CWE-22
Affected products
| Vendor | Product |
|---|---|
| os4ed | opensis |
Description
OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-40651
- [Exploit reference]https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md
- [Exploit reference]https://www.exploit-db.com/exploits/50259
- [Exploit reference]https://youtu.be/wFwlbXANRCo
- [Exploit reference]https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md
- [Exploit reference]https://www.exploit-db.com/exploits/50259
- [Exploit reference]https://youtu.be/wFwlbXANRCo
Related CVEs
Same vendor
- CVE-2021-40618 — An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_C... (9.8 CRITICAL)
- CVE-2021-40617 — An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php (9.8 CRITICAL)
- CVE-2021-40543 — Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_... (9.8 CRITICAL)
- CVE-2021-40542 — Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS) (6.1 MEDIUM)
- CVE-2021-40310 — OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_m... (5.4 MEDIUM)
Same CWE
- CVE-2026-48777 — FileBrowser Quantum is a free, self-hosted, web-based file manager
- CVE-2026-8442 — The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8 (8.1 HIGH)
- CVE-2026-49766 — Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions (9.9 CRITICAL)
- CVE-2026-49061 — Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions (7.5 HIGH)
- CVE-2026-40779 — Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions (7.7 HIGH)