248 matches found
RosarioSIS 6.7.2 - Cross-Site Scripting
RosarioSIS version 6.7.2 and earlier contains a reflected cross-site scripting XSS vulnerability in the Preferences module. The 'tab' parameter in Modules.php is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code via a crafted URL. id: CVE-2020-15718 info: name:...
Rosario Student Information System Unauthenticated SQL Injection
An unauthenticated SQL injection vulnerability in Rosario Student Information System aka rosariosis 8.1 and below allow remote attackers to execute PostgreSQL statements e.g., SELECT, INSERT, UPDATE, and DELETE through /Side.php via the syear parameter. id: CVE-2021-44427 info: name: Rosario...
CVE-2021-45416
Docker RosarioSIS 설치 최소 요구 사항: Docker 및 Git이 작동 중이어야 합니다. DockerHub에서 이미지를 가져오거나 다음을 수행할 수 있습니다: 1. docker 실행 $ git clone https://github.com/dnr6419/CVE-2021-45416.git $ cd CVE-2021-45416 $ docker-compose up -d 2. URL을 방문하여 데이터베이스를 설치합니다 http://YOURIP:80/InstallDatabase.php 3. 그런 다음...
CVE-2021-45416
CVE-2021-45416 RosarioSIS 8.2.1의 반사형 교차 사이트 스크립팅XSS 취약점으로, 공격자가 modules/Scheduling/Courses.php 스크립트의 searchterm 매개변수를 통해 임의의 HTML을 주입할 수 있습니다. 공급업체: francoisjacquet 공급업체 웹사이트: https://www.rosariosis.org/ 영향을 받는 제품: RosarioSIS 영향을 받는 버전: v8.2.1, 그러나 이전 버전도 영향을 받을 수 있다고 추정됩니다 재현 방법: RosarioSIS 8.2....
CVE-2026-93014
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...
CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...
CVE-2026-93014
RosarioSIS versions before 12.9 are affected by a path traversal vulnerability in the filename request parameter within the Users and Students modules. Insufficient validation allows authenticated users to craft parent-directory sequences that escape upload directories and unlink allow-listed fil...
EUVD-2026-81683
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...
CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...
CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...
CVE-2026-93014: Improper Limitation of a Pathname to a Restricted Directory
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...
CVE-2026-19785
A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be...
CVE-2026-19786
A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressin...
CVE-2026-19784
A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 i...
CVE-2026-19786
A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressin...
CVE-2026-19786 francoisjacquet RosarioSIS Modules.php cross-site request forgery
A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressin...
CVE-2026-19786
RosarioSIS (francoisjacquet) up to version 12.8 contains a cross-site request forgery vulnerability arising from improper handling of Modules.php. Exploitation is possible remotely after manipulating the affected processing, with user interaction required for successful abuse per the CVSS data. U...
CVE-2026-19786 francoisjacquet RosarioSIS Modules.php cross-site request forgery
A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressin...
CVE-2026-19786 francoisjacquet RosarioSIS Modules.php cross-site request forgery
A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressin...
EUVD-2026-58571
A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressin...