RO
Product
RosarioSIS
23
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 3Medium 15Low 1
Watch
Add RosarioSIS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-2714 | 9.8 | Sep 6 | Improper Handling of Length Parameter Inconsistency in francoisjacquet/rosariosis Affected: before 10.1 |
| CVE-2021-44567 | 9.8 | Feb 22 | An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php Affected: before 7.6.1 |
| CVE-2021-44427 | 9.8 | Nov 29 | An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g.,… Affected: before 8.1.1 |
| CVE-2022-2067 | 9.1 | Jun 13 | SQL Injection in francoisjacquet/rosariosis Affected: before 9.0 |
| CVE-2023-2665 | 7.5 | May 12 | Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis Affected: before 11.0 |
| CVE-2023-0994 | 7.5 | Feb 24 | Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis Affected: before 10.8.2 |
| CVE-2026-93014 | 7.1 | Sep 17 | RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter Affected: before 12.9 |
| CVE-2023-2202 | 6.5 | Apr 21 | Improper Access Control in francoisjacquet/rosariosis Affected: before 10.9.3 |
| CVE-2026-19785 | 6.3 | Aug 14 | francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection Affected: 12.7.0; 12.7.1; 12.7.2; 12.7.3; 12.7.4 |
| CVE-2021-45416 | 6.1 | Feb 1 | Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the… Affected: 8.2.1 |
| CVE-2020-15718 | 6.1 | Jul 15 | RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script Affected: 6.7.2 |
| CVE-2020-15717 | 6.1 | Jul 15 | RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script Affected: 6.7.2 |
| CVE-2020-15716 | 6.1 | Jul 15 | RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script Affected: 6.7.2 |
| CVE-2020-15721 | 6.1 | Jul 14 | RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php Affected: through 6.7.2; 6.8; 6.8 |
| CVE-2023-29918 | 5.4 | May 2 | RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module Affected: 10.8.4 |
| CVE-2022-3072 | 5.4 | Sep 1 | Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis Affected: before 8.9.3 |
| CVE-2022-2036 | 5.4 | Jun 9 | Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis Affected: before 9.0.1 |
| CVE-2022-1997 | 5.4 | Jun 6 | Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis Affected: before 9.0 |
| CVE-2021-44566 | 5.4 | Feb 22 | A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php Affected: before 4.3 |
| CVE-2021-44565 | 5.4 | Feb 22 | A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject… Affected: before 7.6.1 |
| CVE-2026-19786 | 4.3 | Aug 14 | francoisjacquet RosarioSIS Modules.php cross-site request forgery Affected: 12.0; 12.1; 12.2; 12.3; 12.4; 12.5; +3 more |
| CVE-2026-19784 | 4.3 | Aug 14 | francoisjacquet RosarioSIS Referrals.php DBUpdate authorization Affected: 12.0; 12.1; 12.2; 12.3; 12.4; 12.5; +3 more |
| CVE-2024-3138 | 3.5 | Apr 1 | francoisjacquet RosarioSIS Add Portal Note cross site scripting Affected: 11.5.1 |
Showing 23