francoisjacquet RosarioSIS Modules.php cross-site request forgery
Priority MEDIUM 57CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Tampering, Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352 and CWE-862.
Summary
A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00241 15th percentileScored 2026-11-07
Fix Fixed RosarioSIS (francoisjacquet): 12.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| francoisjacquet | RosarioSIS | 12.0; 12.1; 12.2; 12.3; 12.4; 12.5; 12.6; 12.7; 12.8 | 12.9 | Patch available | CNA |
- RosarioSIS Vendorfrancoisjacquet Affected 12.0; 12.1; 12.2; 12.3; 12.4; 12.5; 12.6; 12.7; 12.8 Fixed in 12.9 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* | — | — | francoisjacquet |
- cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* Versions — — ·francoisjacquet
Remediation
- Fix · CNA RosarioSIS (francoisjacquet) Fixed in 12.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-19786
- 2026-10-03 Alias added: GHSA-3g87-x9p3-8gc7
References
More francoisjacquet vulnerabilities
- TI-2021-20041 An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka… CVSS 3.1CRITICAL 9.8
- TI-2023-00941 Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis CVSS 3.1HIGH 7.5
- TI-2026-62651 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter CVSS 4.0HIGH 7.1
- TI-2021-20153 An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the… CVSS 3.1CRITICAL 9.8
- TI-2023-14071 RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. CVSS 3.1MEDIUM 5.4
- TI-2026-80079 Missing authorization in RosarioSIS teacher save handlers CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-19786 · CVE Program
- CVE-2026-19786 · NVD
- FIRST EPSS
- GHSA-3g87-x9p3-8gc7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences