CVE-2026-116217: falha de média gravidade em francoisjacquet rosariosis
RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu_id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menu_id injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
francoisjacquet · rosariosisReferências
https://github.com/francoisjacquet/rosariosishttps://github.com/francoisjacquet/rosariosis/blob/v12.9.1/modules/Food_Service/MenuReports.php#L315https://github.com/francoisjacquet/rosariosis/commit/08c871da7f9d8478e0e72d104b310b98630fc755https://gitlab.com/francoisjacquet/rosariosis/-/commit/08c871da7f9d8478e0e72d104b310b98630fc755https://www.vulncheck.com/advisories/rosariosis-before-12.9.2-reflected-xss-via-menu-id-in-menureports-php