Cross site scripting in francoisjacquet/rosariosis

2022-02-2500:01:07

Google

osv.dev

0.001 Low

EPSS

Percentile

26.6%

JSON

A Cross Site Scripting (XSS) vulnerabilty exits in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JaveScript of HTML.An example of affected components are all Markdown input fields.

CPENameOperatorVersion
francoisjacquet/rosariosiseq7.0
francoisjacquet/rosariosiseq6.9-beta
francoisjacquet/rosariosiseq6.7.2
francoisjacquet/rosariosiseq5.0.2
francoisjacquet/rosariosiseq7.0.2
francoisjacquet/rosariosiseq5.9
francoisjacquet/rosariosiseq7.1.2
francoisjacquet/rosariosiseq7.1.3
francoisjacquet/rosariosiseq7.3
francoisjacquet/rosariosiseq5.3.1

Name	Operator	Version
francoisjacquet/rosariosis	eq	7.0
francoisjacquet/rosariosis	eq	6.9-beta
francoisjacquet/rosariosis	eq	6.7.2
francoisjacquet/rosariosis	eq	5.0.2
francoisjacquet/rosariosis	eq	7.0.2
francoisjacquet/rosariosis	eq	5.9
francoisjacquet/rosariosis	eq	7.1.2
francoisjacquet/rosariosis	eq	7.1.3
francoisjacquet/rosariosis	eq	7.3
francoisjacquet/rosariosis	eq	5.3.1