{"id":"CVE-2021-40651","aliases":["EUVD-2021-27825","GHSA-7g4r-gjr5-j9m7"],"status":"published","title":"OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php ...","description":"OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.17945,"percentile":0.97224,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2021-09-29T11:59:07Z","modified":"2026-10-24T10:30:58Z","exploits":[{"source":"exploitdb","id":"EDB-50259","title":"OpenSIS 8.0 'modname' - Directory Traversal","type":"webapps","platform":"php","date":"2021-09-03","url":"https://www.exploit-db.com/exploits/50259"},{"source":"nuclei","id":"CVE-2021-40651","title":"OS4Ed OpenSIS Community 8.0 - Local File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40651.yaml"}],"products":[{"vendor":"os4ed","product":"opensis"}],"references":[{"url":"https://youtu.be/wFwlbXANRCo","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://www.exploit-db.com/exploits/50259","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40651"},{"url":"https://github.com/advisories/GHSA-7g4r-gjr5-j9m7"}],"sources":{"cve":[{"id":"CVE-2021-40651","description":"OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.","status":"published","published":"2021-09-29T11:59:07Z","modified":"2024-08-04T02:51:06.297Z","updated_at":"2026-11-02T14:33:01.852999Z"}],"euvd":[{"id":"EUVD-2021-27825","description":"OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.","status":"published","published":"2021-09-29T11:59:07Z","modified":"2024-08-04T02:51:06Z","updated_at":"2026-11-03T03:24:19.692229Z"}],"ghsa":[{"id":"GHSA-7g4r-gjr5-j9m7","title":"OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php ...","description":"OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.","status":"published","published":"2022-05-24T19:16:09Z","modified":"2023-01-30T05:02:32Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:46:39.888016Z"}],"nvd":[{"id":"CVE-2021-40651","description":"OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.","status":"published","published":"2021-09-29T12:15:07.317Z","modified":"2026-06-17T04:07:13.31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:59.314106Z"}],"osv":[{"id":"CVE-2021-40651","description":"OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.","status":"published","published":"2021-09-29T12:15:07.317Z","modified":"2026-10-24T10:30:58.695571129Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:21.249056Z"}]}}