francoisjacquet RosarioSIS Referrals.php DBUpdate authorization
Priority MEDIUM 57CWE-285Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.
Summary
A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00461 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed RosarioSIS (francoisjacquet): 12.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| francoisjacquet | RosarioSIS | 12.0; 12.1; 12.2; 12.3; 12.4; 12.5; 12.6; 12.7; 12.8 | 12.9 | Patch available | CNA |
- RosarioSIS Vendorfrancoisjacquet Affected 12.0; 12.1; 12.2; 12.3; 12.4; 12.5; 12.6; 12.7; 12.8 Fixed in 12.9 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* | — | — | francoisjacquet |
- cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* Versions — — ·francoisjacquet
Remediation
- Fix · CNA RosarioSIS (francoisjacquet) Fixed in 12.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-19784
- 2026-10-03 Alias added: GHSA-9q5c-5jw2-5hfp
References
Patch 2
More francoisjacquet vulnerabilities
- TI-2021-20041 An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka… CVSS 3.1CRITICAL 9.8
- TI-2023-00941 Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis CVSS 3.1HIGH 7.5
- TI-2026-62651 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter CVSS 4.0HIGH 7.1
- TI-2021-20153 An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the… CVSS 3.1CRITICAL 9.8
- TI-2023-14071 RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. CVSS 3.1MEDIUM 5.4
- TI-2026-80079 Missing authorization in RosarioSIS teacher save handlers CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-19784 · CVE Program
- CVE-2026-19784 · NVD
- FIRST EPSS
- GHSA-9q5c-5jw2-5hfp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences