Threat database

RosarioSIS versions prior to 12.9.1 have an authorization bypass vulnerability that allows authenticated teachers to modify records for students outside their assigned course periods. By manipulating specific POST parameters in several PHP scripts, attackers can create or alter referrals, eligibility codes, attendance, and final grades for any student in the system.

CVE-2026-19786 is a cross-site request forgery (CSRF) vulnerability in francoisjacquet RosarioSIS affecting versions up to 12.8. The issue involves improper processing in the Modules.php file that allows remote attackers to perform unauthorized actions via CSRF. Upgrading to version 12.9 addresses this vulnerability. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be launched remotely. Upgrading to version 12.8 is able to resolve this issue. The name of the patch is 6234a0ee0124c0667c824693ac77164f18946ddf. Upgrading the affected component is recommended.

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.