CVE-2020-15718

2020-07-1520:15:13

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.4%

JSON

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. A remote attacker could exploit this vulnerability using the include_inactive parameter in a crafted URL.

CPENameOperatorVersion
rosariosiseq2.8.27
rosariosiseq5.6.3
rosariosiseq4.4-beta
rosariosiseq2.5.3
rosariosiseq5.0.1
rosariosiseq6.5
rosariosiseq2.9.4
rosariosiseq2.8.21
rosariosiseq5.7.1
rosariosiseq5.4

Name	Operator	Version
rosariosis	eq	2.8.27
rosariosis	eq	5.6.3
rosariosis	eq	4.4-beta
rosariosis	eq	2.5.3
rosariosis	eq	5.0.1
rosariosis	eq	6.5
rosariosis	eq	2.9.4
rosariosis	eq	2.8.21
rosariosis	eq	5.7.1
rosariosis	eq	5.4