CVE-2020-6138

PoC —

CVSS 3.1

9.8 critical

EPSS

3%p85

Published

Sep 1, 2020 (Sep 1, 2020)

Modified

Jun 17, 2026

Description

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection An attacker can send an HTTP request to trigger this vulnerability.

Vendors: os4ed
Products: opensis
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.6%)

In the news0 stories

No ingested article mentions this CVE yet.