CVE-2021-41678: OS4ED Opensis

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/users/Staff.php, staff{TITLE] parameter.

Affected products

• OS4ED Opensis: version 8.0 only

Published 2021-11-30. Last modified 2026-06-17.