CVE-2014-9126: Open-School

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YII_CSRF_TOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php.

Affected products

• Open-School Open-School: version 2.2 only

Published 2020-02-08. Last modified 2026-06-17.