CVE-2023-38885: OS4ED Opensis

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request.

Affected products

• OS4ED Opensis: version 9.0 only

Published 2023-11-20. Last modified 2026-06-17.