What’s Vulnerable › Vulnerabilities

CVE-2020-27409

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-04 · updated 2026-06-17
• Weakness: CWE-79

Description

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter.

Affected products

• OS4ED openSIS-Classic: before 7.5 — fixed in 7.5

How to fix

Upgrade to a fixed version: OS4ED openSIS-Classic 7.5. Check the vendor advisory for mitigations.

References

• https://github.com/OS4ED/openSIS-Responsive-Design/commit/edca0855e7bc27d5b28dcb2d16f057ada865e282#diff-5f88e2ce4cd96451df7580911120b4b2
• https://github.com/OS4ED/openSIS-Responsive-Design/compare/ver7.4...V7.5
• https://insinuator.net/2020/10/opensis-vulnerabilities/
• https://github.com/OS4ED/openSIS-Responsive-Design/commit/edca0855e7bc27d5b28dcb2d16f057ada865e282#diff-5f88e2ce4cd96451df7580911120b4b2
• https://github.com/OS4ED/openSIS-Responsive-Design/compare/ver7.4...V7.5
• https://insinuator.net/2020/10/opensis-vulnerabilities/

Get alerted when CVE-2020-27409 or the next vulnerability affects your stack