CVE-2026-121731highCWE-89

CVE-2026-121731: falha de alta gravidade em francoisjacquet RosarioSIS

RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report

Publicada em

Seguir esta CVE+ Monitorar RosarioSIS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.3%
RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
francoisjacquet · RosarioSIS
CVEs relacionadas — francoisjacquet RosarioSIS

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3138LOWfrancoisjacquet RosarioSIS Add Portal Note cross site scriptingEPSS 0.5%CVE-2026-19784MEDIUMfrancoisjacquet RosarioSIS Referrals.php DBUpdate authorizationEPSS 0.5%CVE-2026-19785MEDIUMfrancoisjacquet RosarioSIS Student Medical Medical.inc.php sql injectionEPSS 0.3%CVE-2026-19786MEDIUMfrancoisjacquet RosarioSIS Modules.php cross-site request forgeryEPSS 0.2%CVE-2026-121732LOWRosarioSIS before 12.9 Improper Authorization via Student Billing Mass AssignmentEPSS 0.2%CVE-2026-116010MEDIUMRosarioSIS before 12.9.1 Missing Authorization in Teacher Save HandlersEPSS 0.2%