CVE-2025-22930

Summary

CVE-2025-22930 is a newly disclosed SQL injection vulnerability affecting OS4ED openSIS versions 7.0 to 9.1. An attacker can exploit this issue by manipulating the groupid parameter in the /messaging/Group.php file, allowing unauthorized SQL queries and potential data extraction or modification. This vulnerability poses a serious risk for schools and educational institutions using openSIS, as it may lead to sensitive data breaches or system compromise. To mitigate this threat, affected organizations are urged to apply the necessary patches or upgrades as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.