EUVD-2026-116590

RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student POST array of a...

CVE-2026-121732

RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student POST array of a...

CVE-2026-121732

RosarioSIS versions prior to 12.9 are vulnerable to an improper authorization vulnerability. School-scoped administrators can bypass school isolation by exploiting MassAssignFees.php and MassAssignPayments.php . By substituting foreign student IDs in the student[] POST array during a modfunc=save...

CVE-2026-121732 RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment

RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student POST array of a...

CVE-2026-121732 RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment

RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student POST array of a...