CVE-2020-27409

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/OS4ED/openSIS-Responsive-Design/commit/edca0855e7bc27d5b28dcb2d16f057ada865e282#diff-5f88e2ce4cd96451df7580911120b4b2Patch, Third Party Advisory
https://github.com/OS4ED/openSIS-Responsive-Design/compare/ver7.4...V7.5Third Party Advisory
https://insinuator.net/2020/10/opensis-vulnerabilities/Third Party Advisory
https://github.com/OS4ED/openSIS-Responsive-Design/commit/edca0855e7bc27d5b28dcb2d16f057ada865e282#diff-5f88e2ce4cd96451df7580911120b4b2Patch, Third Party Advisory
https://github.com/OS4ED/openSIS-Responsive-Design/compare/ver7.4...V7.5Third Party Advisory
https://insinuator.net/2020/10/opensis-vulnerabilities/Third Party Advisory

Timeline

Published: Dec 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-27416.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior CVE-2020-274134.2An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password wh CVE-2020-274145.9Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters. This may lead to information disclosure if CVE-2020-274169.8Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to c CVE-2020-274184.4A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers to obatin sensitive information via vgacon_invert_region() CVE-2020-27428.2Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior CVE-2020-274229.8In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the s CVE-2020-274237.5Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on CVE-2020-274286.1A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTM CVE-2020-27436.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior CVE-2020-27445.4Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Security). Supported versions that are affe CVE-2020-274496.1Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote atta