CVE-2025-22931

Summary

CVE-2025-22931 is a vulnerability affecting OS4ED openSIS versions 7.0 to 9.1. This issue involves an insecure direct object reference (IDOR) in the /assets/stafffiles component. Unauthenticated attackers can exploit this vulnerability to gain access to files that have been uploaded by staff members, potentially leading to sensitive data exposure. This IDOR weakness allows unauthorized users to bypass access controls, making it crucial for affected organizations to apply the necessary patches or workarounds to mitigate the risk of data breaches.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.