Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
27 results
Oct 26, 2026RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers tCVE-2026-116217 · Other software · francoisjacquet · reported by VulnCheckMedium 5.3
RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu_id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menu_id injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.
- Product
- rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course peCVE-2026-116010 · Other software · francoisjacquet · reported by VulnCheckMedium 5.3
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.
- Product
- RosarioSIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listCVE-2026-93014 · Other software · RosarioSIS · reported by VulnCheckHigh 7.1
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.
- Product
- RosarioSIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitlab.com
Aug 13, 2026A vulnerability was found in francoisjacquet RosarioSIS up to 12.8.CVE-2026-19786 · Other software · francoisjacquet · reported by VulDBMedium 5.3
A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component.
- Product
- RosarioSIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4.CVE-2026-19785 · Other software · francoisjacquet · reported by VulDBMedium 5.3
A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be launched remotely. Upgrading to version 12.8 is able to resolve this issue. The name of the patch is 6234a0ee0124c0667c824693ac77164f18946ddf. Upgrading the affected component is recommended.
- Product
- RosarioSIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026A flaw has been found in francoisjacquet RosarioSIS up to 12.8.CVE-2026-19784 · Other software · francoisjacquet · reported by VulDBLow 2.1
A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.
- Product
- RosarioSIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2025Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My Preferences module.CVE-2025-29621 · Other software · reported by MITREHigh 7.3
Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My Preferences module. This vulnerability allows attackers to manipulate application settings.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comgetastra.com
Apr 1, 2024** DISPUTED ** A vulnerability was found in francoisjacquet RosarioSIS 11.5.1.CVE-2024-3138 · Other software · francoisjacquet · reported by VulDBLow 3.5
** DISPUTED ** A vulnerability was found in francoisjacquet RosarioSIS 11.5.1. It has been rated as problematic. This issue affects some unknown processing of the component Add Portal Note. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-258911. NOTE: The vendor explains that the PDF is opened by the browser app in a sandbox, so no data from the website should be accessible.
- Product
- RosarioSIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpowerful-bulb-c36.notion.sitevuldb.com
May 11, 2023Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.CVE-2023-2665 · Other software · francoisjacquet · reported by security@huntr.devHigh 7.5
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.CVE-2023-29918 · Other software · Rosariosis · reported by MITREMedium 5.4
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdocs.google.com
Apr 20, 2023Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.CVE-2023-2202 · Other software · francoisjacquet · reported by security@huntr.devMedium 6.5
Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2023Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.CVE-2023-0994 · Other software · francoisjacquet · reported by security@huntr.devHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.CVE-2022-2714 · Other software · francoisjacquet · reported by security@huntr.devCritical 9.8
Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3.CVE-2022-3072 · Other software · francoisjacquet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.CVE-2022-2067 · Other software · francoisjacquet · reported by security@huntr.devCritical 9.1
SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1.CVE-2022-2036 · Other software · francoisjacquet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.CVE-2022-1997 · Other software · francoisjacquet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php.CVE-2021-44567 · Other software · Rosariosis · reported by MITRECritical 9.8
An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php.CVE-2021-44566 · Other software · Rosariosis · reported by MITREMedium 5.4
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious uCVE-2021-44565 · Other software · Rosariosis · reported by MITREMedium 5.4
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/ScCVE-2021-45416 · Other software · Rosariosis · reported by MITREMedium 6.1
Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2021An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQLCVE-2021-44427 · Other software · Rosariosis · reported by MITRECritical 9.8
An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2020Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web scCVE-2020-13278 · Other software · RosarioSIS · reported by cve@gitlab.comMedium 6.1
Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in a GET request.
- Product
- RosarioSIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script.CVE-2020-15718 · Other software · Rosariosis · reported by MITREMedium 6.1
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. A remote attacker could exploit this vulnerability using the include_inactive parameter in a crafted URL.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comgithub.com
Jul 15, 2020RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script.CVE-2020-15717 · Other software · Rosariosis · reported by MITREMedium 6.1
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comgitlab.com
Jul 15, 2020RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script.CVE-2020-15716 · Other software · Rosariosis · reported by MITREMedium 6.1
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remote attacker could exploit this vulnerability using the tab parameter in a crafted URL.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comgithub.com
Jul 14, 2020RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.CVE-2020-15721 · Other software · Rosariosis · reported by MITREMedium 6.1
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.
- Product
- Rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.