CVE-2025-65235

CriticalCVSS 9.8

Published: 26/11/2025(UTC)Updated: 04/11/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

42th percentile - higher than 42% of all known CVEs

Summary

OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function.

Risk Assessment

An attacker could exploit this vulnerability to gain unauthorized access to user data or modify the database.

Recommendation

Update OpenCode Systems USSD Gateway to a version later than 6.13.11. Use parameterized SQL queries and input validation.

Other vulnerabilities in OpenCode Systems USSD Gateway

CVE-2025-65236Critical
OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint.

Original NVD description (English source)

OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS