Search
Find a vulnerability
Search criteria
8 vulnerabilities found for RosarioSIS by francoisjacquet
CVE-2026-19786 (GCVE-0-2026-19786)
Vulnerability from nvd – Published: 2026-08-14 02:30 – Updated: 2026-08-14 14:12 X_Open Source
VLAI
EPSS
VEX
Title
francoisjacquet RosarioSIS Modules.php cross-site request forgery
Summary
A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 14:12 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389746 | vdb-entry |
| https://vuldb.com/vuln/389746/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19786 | third-party-advisory |
| https://vuldb.com/submit/869378 | third-party-advisory |
| https://github.com/francoisjacquet/rosariosis/iss… | issue-tracking |
| https://github.com/francoisjacquet/RosarioSIS/com… | patch |
| https://github.com/francoisjacquet/rosariosis/rel… | patch |
| https://github.com/francoisjacquet/rosariosis/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| francoisjacquet | RosarioSIS |
Affected:
12.0
Affected: 12.1 Affected: 12.2 Affected: 12.3 Affected: 12.4 Affected: 12.5 Affected: 12.6 Affected: 12.7 Affected: 12.8 Unaffected: 12.9 cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19786",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T14:12:46.292487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T14:12:52.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/francoisjacquet/rosariosis/issues/302"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*"
],
"product": "RosarioSIS",
"vendor": "francoisjacquet",
"versions": [
{
"status": "affected",
"version": "12.0"
},
{
"status": "affected",
"version": "12.1"
},
{
"status": "affected",
"version": "12.2"
},
{
"status": "affected",
"version": "12.3"
},
{
"status": "affected",
"version": "12.4"
},
{
"status": "affected",
"version": "12.5"
},
{
"status": "affected",
"version": "12.6"
},
{
"status": "affected",
"version": "12.7"
},
{
"status": "affected",
"version": "12.8"
},
{
"status": "unaffected",
"version": "12.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mitch311 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T02:30:11.223Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389746 | francoisjacquet RosarioSIS Modules.php cross-site request forgery",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/389746"
},
{
"name": "VDB-389746 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389746/cti"
},
{
"name": "CVE-2026-19786 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19786"
},
{
"name": "Submit #869378 | francoisjacquet RosarioSIS \u003c=v12.8 Cross-Site Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/869378"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/francoisjacquet/rosariosis/issues/302"
},
{
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/RosarioSIS/commit/801a71272c82cf4bf695fdc5ed42a9b7511d124d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9"
},
{
"tags": [
"product"
],
"url": "https://github.com/francoisjacquet/rosariosis/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T20:34:11.000Z",
"value": "VulDB entry last update"
}
],
"title": "francoisjacquet RosarioSIS Modules.php cross-site request forgery",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19786",
"datePublished": "2026-08-14T02:30:11.223Z",
"dateReserved": "2026-08-13T18:28:55.822Z",
"dateUpdated": "2026-08-14T14:12:52.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19785 (GCVE-0-2026-19785)
Vulnerability from nvd – Published: 2026-08-14 02:15 – Updated: 2026-08-14 02:15 X_Open Source
VLAI
EPSS
VEX
Title
francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection
Summary
A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be launched remotely. Upgrading to version 12.8 is able to resolve this issue. The name of the patch is 6234a0ee0124c0667c824693ac77164f18946ddf. Upgrading the affected component is recommended.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389745 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389745/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19785 | third-party-advisory |
| https://vuldb.com/submit/869377 | third-party-advisory |
| https://github.com/francoisjacquet/rosariosis/iss… | issue-tracking |
| https://github.com/francoisjacquet/rosariosis/com… | patch |
| https://github.com/francoisjacquet/rosariosis/rel… | patch |
| https://github.com/francoisjacquet/rosariosis/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| francoisjacquet | RosarioSIS |
Affected:
12.7.0
Affected: 12.7.1 Affected: 12.7.2 Affected: 12.7.3 Affected: 12.7.4 Unaffected: 12.8 cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*"
],
"modules": [
"Student Medical Module"
],
"product": "RosarioSIS",
"vendor": "francoisjacquet",
"versions": [
{
"status": "affected",
"version": "12.7.0"
},
{
"status": "affected",
"version": "12.7.1"
},
{
"status": "affected",
"version": "12.7.2"
},
{
"status": "affected",
"version": "12.7.3"
},
{
"status": "affected",
"version": "12.7.4"
},
{
"status": "unaffected",
"version": "12.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mitch311 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be launched remotely. Upgrading to version 12.8 is able to resolve this issue. The name of the patch is 6234a0ee0124c0667c824693ac77164f18946ddf. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T02:15:10.506Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389745 | francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389745"
},
{
"name": "VDB-389745 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389745/cti"
},
{
"name": "CVE-2026-19785 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19785"
},
{
"name": "Submit #869377 | francoisjacquet RosarioSIS \u003c=v12.8 Improper Authorization / Arbitrary Data Deletion",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/869377"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/francoisjacquet/rosariosis/issues/302"
},
{
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/rosariosis/commit/6234a0ee0124c0667c824693ac77164f18946ddf"
},
{
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/rosariosis/releases/tag/v12.8"
},
{
"tags": [
"product"
],
"url": "https://github.com/francoisjacquet/rosariosis/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T20:34:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19785",
"datePublished": "2026-08-14T02:15:10.506Z",
"dateReserved": "2026-08-13T18:28:52.116Z",
"dateUpdated": "2026-08-14T02:15:10.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19784 (GCVE-0-2026-19784)
Vulnerability from nvd – Published: 2026-08-14 02:00 – Updated: 2026-08-14 14:56 X_Open Source
VLAI
EPSS
VEX
Title
francoisjacquet RosarioSIS Referrals.php DBUpdate authorization
Summary
A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 14:56 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389744 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389744/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19784 | third-party-advisory |
| https://vuldb.com/submit/869367 | third-party-advisory |
| https://github.com/francoisjacquet/rosariosis/iss… | issue-tracking |
| https://github.com/francoisjacquet/RosarioSIS/iss… | exploitissue-tracking |
| https://github.com/francoisjacquet/RosarioSIS/com… | patch |
| https://github.com/francoisjacquet/rosariosis/rel… | patch |
| https://github.com/francoisjacquet/rosariosis/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| francoisjacquet | RosarioSIS |
Affected:
12.0
Affected: 12.1 Affected: 12.2 Affected: 12.3 Affected: 12.4 Affected: 12.5 Affected: 12.6 Affected: 12.7 Affected: 12.8 Unaffected: 12.9 cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19784",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T14:56:06.717807Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T14:56:21.912Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*"
],
"product": "RosarioSIS",
"vendor": "francoisjacquet",
"versions": [
{
"status": "affected",
"version": "12.0"
},
{
"status": "affected",
"version": "12.1"
},
{
"status": "affected",
"version": "12.2"
},
{
"status": "affected",
"version": "12.3"
},
{
"status": "affected",
"version": "12.4"
},
{
"status": "affected",
"version": "12.5"
},
{
"status": "affected",
"version": "12.6"
},
{
"status": "affected",
"version": "12.7"
},
{
"status": "affected",
"version": "12.8"
},
{
"status": "unaffected",
"version": "12.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mitch311 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T02:00:12.158Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389744 | francoisjacquet RosarioSIS Referrals.php DBUpdate authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389744"
},
{
"name": "VDB-389744 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389744/cti"
},
{
"name": "CVE-2026-19784 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19784"
},
{
"name": "Submit #869367 | francoisjacquet RosarioSIS \u003c=v12.8 Incorrect Authorization / IDOR",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/869367"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/francoisjacquet/rosariosis/issues/301"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/francoisjacquet/RosarioSIS/issues/301"
},
{
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/RosarioSIS/commit/04dd1a368ddf80ad7082baefa3c656e4e1825c76"
},
{
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9"
},
{
"tags": [
"product"
],
"url": "https://github.com/francoisjacquet/rosariosis/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T20:34:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "francoisjacquet RosarioSIS Referrals.php DBUpdate authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19784",
"datePublished": "2026-08-14T02:00:12.158Z",
"dateReserved": "2026-08-13T18:28:48.100Z",
"dateUpdated": "2026-08-14T14:56:21.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-3138 (GCVE-0-2024-3138)
Vulnerability from nvd – Published: 2024-04-01 22:00 – Updated: 2024-08-23 17:13 Disputed
VLAI
EPSS
VEX
Title
francoisjacquet RosarioSIS Add Portal Note cross site scripting
Summary
** DISPUTED ** A vulnerability was found in francoisjacquet RosarioSIS 11.5.1. It has been rated as problematic. This issue affects some unknown processing of the component Add Portal Note. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-258911. NOTE: The vendor explains that the PDF is opened by the browser app in a sandbox, so no data from the website should be accessible.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-23 17:10 UTC
CWE
- CWE-79 - Cross Site Scripting
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.258911 | vdb-entry |
| https://vuldb.com/?ctiid.258911 | signaturepermissions-required |
| https://vuldb.com/?submit.307450 | third-party-advisory |
| https://powerful-bulb-c36.notion.site/Stored-xss-… | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| francoisjacquet | RosarioSIS |
Affected:
11.5.1
|
|
| rosariosis | rosariosis |
Affected:
11.5.1
cpe:2.3:a:rosariosis:rosariosis:11.5.1:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T19:32:42.711Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-258911 | francoisjacquet RosarioSIS Add Portal Note cross site scripting",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://vuldb.com/?id.258911"
},
{
"name": "VDB-258911 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.258911"
},
{
"name": "Submit #307450 | RosarioSIS RosarioSIS Student Information System v11.5.1 stored XSS at add portal note",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://vuldb.com/?submit.307450"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://powerful-bulb-c36.notion.site/Stored-xss-via-malicious-PDF-upload-98fb1ea6b9bf4ddfaf04d61b2c05410a"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:rosariosis:rosariosis:11.5.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rosariosis",
"vendor": "rosariosis",
"versions": [
{
"status": "affected",
"version": "11.5.1"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-3138",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-23T17:10:47.673225Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-23T17:13:10.958Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Add Portal Note"
],
"product": "RosarioSIS",
"vendor": "francoisjacquet",
"versions": [
{
"status": "affected",
"version": "11.5.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "louay khammassi (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "** DISPUTED ** A vulnerability was found in francoisjacquet RosarioSIS 11.5.1. It has been rated as problematic. This issue affects some unknown processing of the component Add Portal Note. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-258911. NOTE: The vendor explains that the PDF is opened by the browser app in a sandbox, so no data from the website should be accessible."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in francoisjacquet RosarioSIS 11.5.1 ausgemacht. Sie wurde als problematisch eingestuft. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Komponente Add Portal Note. Durch Manipulation mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Bisher konnte die Existenz der vermeintlichen Schwachstelle noch nicht eindeutig nachgewiesen werden."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-01T22:00:05.787Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-258911 | francoisjacquet RosarioSIS Add Portal Note cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.258911"
},
{
"name": "VDB-258911 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.258911"
},
{
"name": "Submit #307450 | RosarioSIS RosarioSIS Student Information System v11.5.1 stored XSS at add portal note",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.307450"
},
{
"tags": [
"exploit"
],
"url": "https://powerful-bulb-c36.notion.site/Stored-xss-via-malicious-PDF-upload-98fb1ea6b9bf4ddfaf04d61b2c05410a"
}
],
"tags": [
"disputed"
],
"timeline": [
{
"lang": "en",
"time": "2024-04-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-04-01T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-01T18:52:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "francoisjacquet RosarioSIS Add Portal Note cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-3138",
"datePublished": "2024-04-01T22:00:05.787Z",
"dateReserved": "2024-04-01T16:44:05.106Z",
"dateUpdated": "2024-08-23T17:13:10.958Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-19786 (GCVE-0-2026-19786)
Vulnerability from cvelistv5 – Published: 2026-08-14 02:30 – Updated: 2026-08-14 14:12 X_Open Source
VLAI
EPSS
VEX
Title
francoisjacquet RosarioSIS Modules.php cross-site request forgery
Summary
A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 14:12 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389746 | vdb-entry |
| https://vuldb.com/vuln/389746/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19786 | third-party-advisory |
| https://vuldb.com/submit/869378 | third-party-advisory |
| https://github.com/francoisjacquet/rosariosis/iss… | issue-tracking |
| https://github.com/francoisjacquet/RosarioSIS/com… | patch |
| https://github.com/francoisjacquet/rosariosis/rel… | patch |
| https://github.com/francoisjacquet/rosariosis/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| francoisjacquet | RosarioSIS |
Affected:
12.0
Affected: 12.1 Affected: 12.2 Affected: 12.3 Affected: 12.4 Affected: 12.5 Affected: 12.6 Affected: 12.7 Affected: 12.8 Unaffected: 12.9 cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19786",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T14:12:46.292487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T14:12:52.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/francoisjacquet/rosariosis/issues/302"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*"
],
"product": "RosarioSIS",
"vendor": "francoisjacquet",
"versions": [
{
"status": "affected",
"version": "12.0"
},
{
"status": "affected",
"version": "12.1"
},
{
"status": "affected",
"version": "12.2"
},
{
"status": "affected",
"version": "12.3"
},
{
"status": "affected",
"version": "12.4"
},
{
"status": "affected",
"version": "12.5"
},
{
"status": "affected",
"version": "12.6"
},
{
"status": "affected",
"version": "12.7"
},
{
"status": "affected",
"version": "12.8"
},
{
"status": "unaffected",
"version": "12.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mitch311 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T02:30:11.223Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389746 | francoisjacquet RosarioSIS Modules.php cross-site request forgery",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/389746"
},
{
"name": "VDB-389746 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389746/cti"
},
{
"name": "CVE-2026-19786 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19786"
},
{
"name": "Submit #869378 | francoisjacquet RosarioSIS \u003c=v12.8 Cross-Site Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/869378"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/francoisjacquet/rosariosis/issues/302"
},
{
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/RosarioSIS/commit/801a71272c82cf4bf695fdc5ed42a9b7511d124d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9"
},
{
"tags": [
"product"
],
"url": "https://github.com/francoisjacquet/rosariosis/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T20:34:11.000Z",
"value": "VulDB entry last update"
}
],
"title": "francoisjacquet RosarioSIS Modules.php cross-site request forgery",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19786",
"datePublished": "2026-08-14T02:30:11.223Z",
"dateReserved": "2026-08-13T18:28:55.822Z",
"dateUpdated": "2026-08-14T14:12:52.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19785 (GCVE-0-2026-19785)
Vulnerability from cvelistv5 – Published: 2026-08-14 02:15 – Updated: 2026-08-14 02:15 X_Open Source
VLAI
EPSS
VEX
Title
francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection
Summary
A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be launched remotely. Upgrading to version 12.8 is able to resolve this issue. The name of the patch is 6234a0ee0124c0667c824693ac77164f18946ddf. Upgrading the affected component is recommended.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389745 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389745/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19785 | third-party-advisory |
| https://vuldb.com/submit/869377 | third-party-advisory |
| https://github.com/francoisjacquet/rosariosis/iss… | issue-tracking |
| https://github.com/francoisjacquet/rosariosis/com… | patch |
| https://github.com/francoisjacquet/rosariosis/rel… | patch |
| https://github.com/francoisjacquet/rosariosis/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| francoisjacquet | RosarioSIS |
Affected:
12.7.0
Affected: 12.7.1 Affected: 12.7.2 Affected: 12.7.3 Affected: 12.7.4 Unaffected: 12.8 cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*"
],
"modules": [
"Student Medical Module"
],
"product": "RosarioSIS",
"vendor": "francoisjacquet",
"versions": [
{
"status": "affected",
"version": "12.7.0"
},
{
"status": "affected",
"version": "12.7.1"
},
{
"status": "affected",
"version": "12.7.2"
},
{
"status": "affected",
"version": "12.7.3"
},
{
"status": "affected",
"version": "12.7.4"
},
{
"status": "unaffected",
"version": "12.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mitch311 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be launched remotely. Upgrading to version 12.8 is able to resolve this issue. The name of the patch is 6234a0ee0124c0667c824693ac77164f18946ddf. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T02:15:10.506Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389745 | francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389745"
},
{
"name": "VDB-389745 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389745/cti"
},
{
"name": "CVE-2026-19785 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19785"
},
{
"name": "Submit #869377 | francoisjacquet RosarioSIS \u003c=v12.8 Improper Authorization / Arbitrary Data Deletion",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/869377"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/francoisjacquet/rosariosis/issues/302"
},
{
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/rosariosis/commit/6234a0ee0124c0667c824693ac77164f18946ddf"
},
{
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/rosariosis/releases/tag/v12.8"
},
{
"tags": [
"product"
],
"url": "https://github.com/francoisjacquet/rosariosis/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T20:34:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19785",
"datePublished": "2026-08-14T02:15:10.506Z",
"dateReserved": "2026-08-13T18:28:52.116Z",
"dateUpdated": "2026-08-14T02:15:10.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19784 (GCVE-0-2026-19784)
Vulnerability from cvelistv5 – Published: 2026-08-14 02:00 – Updated: 2026-08-14 14:56 X_Open Source
VLAI
EPSS
VEX
Title
francoisjacquet RosarioSIS Referrals.php DBUpdate authorization
Summary
A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 14:56 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389744 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389744/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19784 | third-party-advisory |
| https://vuldb.com/submit/869367 | third-party-advisory |
| https://github.com/francoisjacquet/rosariosis/iss… | issue-tracking |
| https://github.com/francoisjacquet/RosarioSIS/iss… | exploitissue-tracking |
| https://github.com/francoisjacquet/RosarioSIS/com… | patch |
| https://github.com/francoisjacquet/rosariosis/rel… | patch |
| https://github.com/francoisjacquet/rosariosis/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| francoisjacquet | RosarioSIS |
Affected:
12.0
Affected: 12.1 Affected: 12.2 Affected: 12.3 Affected: 12.4 Affected: 12.5 Affected: 12.6 Affected: 12.7 Affected: 12.8 Unaffected: 12.9 cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19784",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T14:56:06.717807Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T14:56:21.912Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*"
],
"product": "RosarioSIS",
"vendor": "francoisjacquet",
"versions": [
{
"status": "affected",
"version": "12.0"
},
{
"status": "affected",
"version": "12.1"
},
{
"status": "affected",
"version": "12.2"
},
{
"status": "affected",
"version": "12.3"
},
{
"status": "affected",
"version": "12.4"
},
{
"status": "affected",
"version": "12.5"
},
{
"status": "affected",
"version": "12.6"
},
{
"status": "affected",
"version": "12.7"
},
{
"status": "affected",
"version": "12.8"
},
{
"status": "unaffected",
"version": "12.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mitch311 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T02:00:12.158Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389744 | francoisjacquet RosarioSIS Referrals.php DBUpdate authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389744"
},
{
"name": "VDB-389744 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389744/cti"
},
{
"name": "CVE-2026-19784 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19784"
},
{
"name": "Submit #869367 | francoisjacquet RosarioSIS \u003c=v12.8 Incorrect Authorization / IDOR",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/869367"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/francoisjacquet/rosariosis/issues/301"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/francoisjacquet/RosarioSIS/issues/301"
},
{
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/RosarioSIS/commit/04dd1a368ddf80ad7082baefa3c656e4e1825c76"
},
{
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9"
},
{
"tags": [
"product"
],
"url": "https://github.com/francoisjacquet/rosariosis/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-13T20:34:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "francoisjacquet RosarioSIS Referrals.php DBUpdate authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19784",
"datePublished": "2026-08-14T02:00:12.158Z",
"dateReserved": "2026-08-13T18:28:48.100Z",
"dateUpdated": "2026-08-14T14:56:21.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-3138 (GCVE-0-2024-3138)
Vulnerability from cvelistv5 – Published: 2024-04-01 22:00 – Updated: 2024-08-23 17:13 Disputed
VLAI
EPSS
VEX
Title
francoisjacquet RosarioSIS Add Portal Note cross site scripting
Summary
** DISPUTED ** A vulnerability was found in francoisjacquet RosarioSIS 11.5.1. It has been rated as problematic. This issue affects some unknown processing of the component Add Portal Note. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-258911. NOTE: The vendor explains that the PDF is opened by the browser app in a sandbox, so no data from the website should be accessible.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-23 17:10 UTC
CWE
- CWE-79 - Cross Site Scripting
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.258911 | vdb-entry |
| https://vuldb.com/?ctiid.258911 | signaturepermissions-required |
| https://vuldb.com/?submit.307450 | third-party-advisory |
| https://powerful-bulb-c36.notion.site/Stored-xss-… | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| francoisjacquet | RosarioSIS |
Affected:
11.5.1
|
|
| rosariosis | rosariosis |
Affected:
11.5.1
cpe:2.3:a:rosariosis:rosariosis:11.5.1:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T19:32:42.711Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-258911 | francoisjacquet RosarioSIS Add Portal Note cross site scripting",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://vuldb.com/?id.258911"
},
{
"name": "VDB-258911 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.258911"
},
{
"name": "Submit #307450 | RosarioSIS RosarioSIS Student Information System v11.5.1 stored XSS at add portal note",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://vuldb.com/?submit.307450"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://powerful-bulb-c36.notion.site/Stored-xss-via-malicious-PDF-upload-98fb1ea6b9bf4ddfaf04d61b2c05410a"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:rosariosis:rosariosis:11.5.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rosariosis",
"vendor": "rosariosis",
"versions": [
{
"status": "affected",
"version": "11.5.1"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-3138",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-23T17:10:47.673225Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-23T17:13:10.958Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Add Portal Note"
],
"product": "RosarioSIS",
"vendor": "francoisjacquet",
"versions": [
{
"status": "affected",
"version": "11.5.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "louay khammassi (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "** DISPUTED ** A vulnerability was found in francoisjacquet RosarioSIS 11.5.1. It has been rated as problematic. This issue affects some unknown processing of the component Add Portal Note. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-258911. NOTE: The vendor explains that the PDF is opened by the browser app in a sandbox, so no data from the website should be accessible."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in francoisjacquet RosarioSIS 11.5.1 ausgemacht. Sie wurde als problematisch eingestuft. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Komponente Add Portal Note. Durch Manipulation mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Bisher konnte die Existenz der vermeintlichen Schwachstelle noch nicht eindeutig nachgewiesen werden."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-01T22:00:05.787Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-258911 | francoisjacquet RosarioSIS Add Portal Note cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.258911"
},
{
"name": "VDB-258911 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.258911"
},
{
"name": "Submit #307450 | RosarioSIS RosarioSIS Student Information System v11.5.1 stored XSS at add portal note",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.307450"
},
{
"tags": [
"exploit"
],
"url": "https://powerful-bulb-c36.notion.site/Stored-xss-via-malicious-PDF-upload-98fb1ea6b9bf4ddfaf04d61b2c05410a"
}
],
"tags": [
"disputed"
],
"timeline": [
{
"lang": "en",
"time": "2024-04-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-04-01T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-01T18:52:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "francoisjacquet RosarioSIS Add Portal Note cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-3138",
"datePublished": "2024-04-01T22:00:05.787Z",
"dateReserved": "2024-04-01T16:44:05.106Z",
"dateUpdated": "2024-08-23T17:13:10.958Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}