CVE-2026-121732lowCWE-639

CVE-2026-121732: falha de baixa gravidade em francoisjacquet RosarioSIS

RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment

Publicada em

Seguir esta CVE+ Monitorar RosarioSIS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.1epss 0.2%
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
francoisjacquet · RosarioSIS
CVEs relacionadas — francoisjacquet RosarioSIS

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3138LOWfrancoisjacquet RosarioSIS Add Portal Note cross site scriptingEPSS 0.5%CVE-2026-19784MEDIUMfrancoisjacquet RosarioSIS Referrals.php DBUpdate authorizationEPSS 0.5%CVE-2026-19785MEDIUMfrancoisjacquet RosarioSIS Student Medical Medical.inc.php sql injectionEPSS 0.3%CVE-2026-121731HIGHRosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence ReportEPSS 0.3%CVE-2026-19786MEDIUMfrancoisjacquet RosarioSIS Modules.php cross-site request forgeryEPSS 0.2%CVE-2026-116010MEDIUMRosarioSIS before 12.9.1 Missing Authorization in Teacher Save HandlersEPSS 0.2%