CVE-2026-116217

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php lin...

EUVD-2026-109809

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php lin...