CVE-2026-116010

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the starr, values, or attendance POST arrays in MakeReferral.php,...

CVE-2026-116010 RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the starr, values, or attendance POST arrays in MakeReferral.php,...

CVE-2026-116010

RosarioSIS versions prior to 12.9.1 are susceptible to a missing authorization vulnerability. Authenticated teachers can manipulate records for students outside their assigned course periods by providing arbitrary student IDs. Specifically, an attacker can modify the st_arr, values, or attendance...

EUVD-2026-109268

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the starr, values, or attendance POST arrays in MakeReferral.php,...

CVE-2026-116010 RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the starr, values, or attendance POST arrays in MakeReferral.php,...

PT-2026-122591

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st arr, values, or attendance POST arrays in MakeReferral.php,...

CVE-2021-41679

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/grades/InputFinalGrades.php, period parameter...

CVE-2021-41679

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/grades/InputFinalGrades.php, period parameter...

CVE-2021-41679

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/grades/InputFinalGrades.php, period parameter...

CVE-2021-41679: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/grades/InputFinalGrades.php, period parameter...

PT-2021-6948

Name of the Vulnerable Software and Affected Versions openSIS version 8.0 Description A SQL injection issue exists when MySQL or MariaDB is used as the application database. This allows an attacker to issue SQL commands through the "opensis/modules/grades/InputFinalGrades.php" endpoint,...