https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 10:15:56 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-93014 <p>RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users&#39; documents throughout the installation.</p> <p>RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users&#39; documents throughout the installation.</p> https://db.gcve.eu/vuln/fkie_cve-2026-93014 https://db.gcve.eu/vuln/ghsa-qmmf-hm9j-j4mj <p>RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users&#39; documents throughout the installation.</p> <p>RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users&#39; documents throughout the installation.</p> https://db.gcve.eu/vuln/ghsa-qmmf-hm9j-j4mj