CVE-2025-65236

Critical · 9.8

CVSS

9.8

EPSS

0.4%

Published

Nov 26, 2025

CISA due date

—

The record

OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint.

Affected packages

Ecosystem	Package	Introduced	Fixed