Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: francoisjacquet RosarioSIS 12.9 Clear all filters
TI-2026-84853 CVE-2026-121732 · GHSA-mfq4-wm65-76f5

RosarioSIS billing flaw lets admins alter other schools' balances

Priority LOW 11

RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00236 Published 2026-11-03 Fixed in 12.9 CWE-639
TI-2026-84852 CVE-2026-121731 · GHSA-97v2-f3v8-3cfx

SQL injection in RosarioSIS attendance absence report

Priority LOW 37

RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00302 Published 2026-11-03 Fixed in 12.9 CWE-89