PatchTheCVE: opencodehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-70614: OpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 contains a broken access control vulnerability https://patchthecve.com/cve/CVE-2025-70614.htmlhttps://patchthecve.com/cve/CVE-2025-70614.htmlWed, 17 Jun 2026 10:03:20 +0000HIGH 8.1: OpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 contains a broken access control vulnerability in the web-based control panel allowing authenticated low-privileged attackers to gain to access to arbitrary SMS messages via a crafted company or tenant identifier parameter.CVE-2025-65239: Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, verhttps://patchthecve.com/cve/CVE-2025-65239.htmlhttps://patchthecve.com/cve/CVE-2025-65239.htmlWed, 17 Jun 2026 09:55:35 +0000MEDIUM 4.3: Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level privileges to read server logs.CVE-2025-65238: Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 https://patchthecve.com/cve/CVE-2025-65238.htmlhttps://patchthecve.com/cve/CVE-2025-65238.htmlWed, 17 Jun 2026 09:55:35 +0000MEDIUM 6.5: Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level privileges to dump user records and access sensitive information.CVE-2025-65237: A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attahttps://patchthecve.com/cve/CVE-2025-65237.htmlhttps://patchthecve.com/cve/CVE-2025-65237.htmlWed, 17 Jun 2026 09:55:34 +0000MEDIUM 6.1: A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload.CVE-2025-65236: OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Sehttps://patchthecve.com/cve/CVE-2025-65236.htmlhttps://patchthecve.com/cve/CVE-2025-65236.htmlWed, 17 Jun 2026 09:55:34 +0000CRITICAL 9.8: OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint.CVE-2025-65235: OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerabhttps://patchthecve.com/cve/CVE-2025-65235.htmlhttps://patchthecve.com/cve/CVE-2025-65235.htmlWed, 17 Jun 2026 09:55:34 +0000CRITICAL 9.8: OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function.