Skip to content
Fencer Vulns
medium 6.5

CVE-2021-40651 json

OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose ar…

published 2021-09-29 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-27825

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
17.9%
EPSS 17.9% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB, plus a Nuclei check

Summary

OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.

Timeline

  1. First public exploit (EDB-50259)
  2. Published

Exploit prediction

17.95% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-50259 OpenSIS 8.0 'modname' - Directory Traversal webapps, 2021-09-03
  • Nuclei template OS4Ed OpenSIS Community 8.0 - Local File Inclusion nuclei detection template
  • youtu.be https://youtu.be/wFwlbXANRCo referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.