https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 21:46:40 +0000 https://db.gcve.eu/vuln/cve-2026-121732 <p><strong>Affected:</strong> francoisjacquet RosarioSIS</p> <p>RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools&#39; student billing balances, breaking school isolation.</p> <p><strong>Affected:</strong> francoisjacquet RosarioSIS</p> <p>RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools&#39; student billing balances, breaking school isolation.</p> https://db.gcve.eu/vuln/cve-2026-121732