Description
A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-20
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Apply Patch
AI Analysis

Impact

A flaw in the Item::findUserItems function allows an attacker to inject arbitrary SQL by manipulating the sPattern parameter. The weakness falls under CWE-74 and CWE-89 and could let a remote adversary read, modify, or delete database data, jeopardizing confidentiality, integrity, or availability of the application.

Affected Systems

Osclass releases up to and including version 8.3.1 are affected. The vulnerability resides in the Item Model Handler located in oc-includes/osclass/model/Item.php and applies to any installation running one of the listed Osclass versions.

Risk and Exploitability

The CVSS score of 6.9 reflects moderate severity, while the EPSS value of less than 1% indicates a low probability of exploitation at present. Although the flaw is not listed in the CISA KEV catalog, public exploit code is available and the issue can be triggered remotely. Consequently, the vulnerability poses a tangible risk if left unpatched.

Generated by OpenCVE AI on October 20, 2026 at 14:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Osclass to a version newer than 8.3.1 where the Item::findUserItems routine is corrected.
  • Modify the Item::findUserItems implementation to use parameterized queries or otherwise sanitize the sPattern input so that injected SQL statements cannot be executed.
  • Limit the database account used by the application to the least privileges necessary, removing write or delete access to tables that are not required for normal operation.

Generated by OpenCVE AI on October 20, 2026 at 14:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Osclass Item Model Item.php findUserItems sql injection
First Time appeared Osclass
Osclass osclass
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:osclass:osclass:*:*:*:*:*:*:*:*
Vendors & Products Osclass
Osclass osclass
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Osclass Osclass
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-20T13:28:23.121Z

Reserved: 2026-10-20T04:25:45.758Z

Link: CVE-2026-113381

cve-icon Vulnrichment

Updated: 2026-10-20T13:28:14.822Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T10:17:05.243

Modified: 2026-10-20T19:27:34.430

Link: CVE-2026-113381

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T15:15:14Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')