CVE-2026-116010

RosarioSIS versions prior to 12.9.1 are susceptible to a missing authorization vulnerability. Authenticated teachers can manipulate records for students outside their assigned course periods by providing arbitrary student IDs. Specifically, an attacker can modify the st_arr, values, or attendance...

EUVD-2026-109268

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the starr, values, or attendance POST arrays in MakeReferral.php,...