- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 17 · 2 critical, 6 high, 3 medium, 1 low
- Registry
- Packagist
Advisories 17
- CVE-2024-3138Low 3.5
francoisjacquet RosarioSIS Add Portal Note cross site scripting
Affected: through 11.5.1.
- CVE-2023-2665High 7.5
Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis
Affected: fixed in 11.0.
- CVE-2023-29918Medium 5.4
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
Affected: through 10.8.4.
- CVE-2023-2202Medium 4.6
Improper Access Control in francoisjacquet/rosariosis
Affected: fixed in 10.9.3.
- CVE-2023-0994High 8.1
Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis
Affected: fixed in 10.8.2.
- CVE-2022-2714High 8.1
Improper Handling of Length Parameter Inconsistency in francoisjacquet/rosariosis
Affected: fixed in 10.1.
- CVE-2022-3072High 8.0
Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
Affected: fixed in 8.9.3.
- CVE-2022-2067High 8.8
SQL Injection in francoisjacquet/rosariosis
Affected: fixed in 9.0.
- CVE-2022-2036Critical 9.0
Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
Affected: fixed in 9.1.
- CVE-2022-1997High 8.8
Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
Affected: fixed in 9.0.
- CVE-2021-44567Unrated
An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in…
Affected: fixed in 7.6.1.
- CVE-2021-44566Unrated
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in…
Affected: fixed in 4.3.
- CVE-2021-44565Unrated
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which…
Affected: fixed in 7.6.1.
- CVE-2021-45416Unrated
Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term…
Affected: fixed in 8.3.
- CVE-2021-44427Critical 9.8
An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers…
Affected: fixed in 8.1.1.
Show all 17 advisoriesShow fewer advisories
- CVE-2020-13278Medium 6.1
Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to…
Affected: fixed in 6.5.1.
- CVE-2020-15721Unrated
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.
Affected: fixed in 6.8.