CVE-2014-9126: Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attac...

Security readout for executives and security teams

Open-School Community Edition 2.2 has multiple cross-site scripting flaws that could let a remote attacker inject script or HTML into user-facing pages. This can affect staff or student browser sessions if vulnerable pages are reached. The sources do not provide a CVSS score, confirmed exploitation, or a vendor patch. Exposure is likely limited to organizations still running Open-School Community Edition 2.2, especially if the application is internet-facing or accessible to untrusted users. The source bundle does not identify other affected products or versions. Treat as a targeted web application risk, not a broad emergency. Prioritize quickly if the software is public-facing or used by sensitive school records workflows. If no deployment exists, no further action is needed beyond documentation. Mitigation focus: Inventory for Open-School Community Edition 2.2 deployments.; Check vendor or project guidance for fixed versions or maintained replacements.; Restrict access to trusted users or networks while assessing exposure..

Prepared

Jun 6, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.