# francoisjacquet/rosariosis (Packagist) vulnerabilities

17 known vulnerabilities (2 critical, 6 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/francoisjacquet/rosariosis

## Advisories (17)

### [CVE-2024-3138](https://cve.now/CVE-2024-3138): francoisjacquet RosarioSIS Add Portal Note cross site scripting

- Severity: Low 3.5
- Published: Apr 1, 2024
- Affected: through 11.5.1.

### [CVE-2023-2665](https://cve.now/CVE-2023-2665): Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis

- Severity: High 7.5
- Published: May 12, 2023
- Affected: fixed in 11.0.

### [CVE-2023-29918](https://cve.now/CVE-2023-29918): RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

- Severity: Medium 5.4
- Published: May 2, 2023
- Affected: through 10.8.4.

### [CVE-2023-2202](https://cve.now/CVE-2023-2202): Improper Access Control in francoisjacquet/rosariosis

- Severity: Medium 4.6
- Published: Apr 21, 2023
- Affected: fixed in 10.9.3.

### [CVE-2023-0994](https://cve.now/CVE-2023-0994): Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis

- Severity: High 8.1
- Published: Feb 24, 2023
- Affected: fixed in 10.8.2.

### [CVE-2022-2714](https://cve.now/CVE-2022-2714): Improper Handling of Length Parameter Inconsistency in francoisjacquet/rosariosis

- Severity: High 8.1
- Published: Sep 6, 2022
- Affected: fixed in 10.1.

### [CVE-2022-3072](https://cve.now/CVE-2022-3072): Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis

- Severity: High 8.0
- Published: Sep 1, 2022
- Affected: fixed in 8.9.3.

### [CVE-2022-2067](https://cve.now/CVE-2022-2067): SQL Injection in francoisjacquet/rosariosis

- Severity: High 8.8
- Published: Jun 13, 2022
- Affected: fixed in 9.0.

### [CVE-2022-2036](https://cve.now/CVE-2022-2036): Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis

- Severity: Critical 9.0
- Published: Jun 9, 2022
- Affected: fixed in 9.1.

### [CVE-2022-1997](https://cve.now/CVE-2022-1997): Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis

- Severity: High 8.8
- Published: Jun 6, 2022
- Affected: fixed in 9.0.

### [CVE-2021-44567](https://cve.now/CVE-2021-44567): An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in…

- Severity: Unrated
- Published: Feb 22, 2022
- Affected: fixed in 7.6.1.

### [CVE-2021-44566](https://cve.now/CVE-2021-44566): A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in…

- Severity: Unrated
- Published: Feb 22, 2022
- Affected: fixed in 4.3.

### [CVE-2021-44565](https://cve.now/CVE-2021-44565): A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss\_clean function in classes/Security.php, which…

- Severity: Unrated
- Published: Feb 22, 2022
- Affected: fixed in 7.6.1.

### [CVE-2021-45416](https://cve.now/CVE-2021-45416): Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search\_term…

- Severity: Unrated
- Published: Feb 1, 2022
- Affected: fixed in 8.3.

### [CVE-2021-44427](https://cve.now/CVE-2021-44427): An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers…

- Severity: Critical 9.8
- Published: Nov 29, 2021
- Affected: fixed in 8.1.1.

### [CVE-2020-13278](https://cve.now/CVE-2020-13278): Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System \< 6.5.1 allows remote attackers to…

- Severity: Medium 6.1
- Published: Aug 12, 2020
- Affected: fixed in 6.5.1.

### [CVE-2020-15721](https://cve.now/CVE-2020-15721): RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.

- Severity: Unrated
- Published: Jul 14, 2020
- Affected: fixed in 6.8.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/francoisjacquet/rosariosis
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.