Filtered by vendor Rosariosis Subscriptions
Total 19 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-2665 1 Rosariosis 1 Rosariosis 2024-11-21 7.5 High
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
CVE-2023-2202 1 Rosariosis 1 Rosariosis 2024-11-21 6.5 Medium
Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.
CVE-2023-29918 1 Rosariosis 1 Rosariosis 2024-11-21 5.4 Medium
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
CVE-2023-0994 1 Rosariosis 1 Rosariosis 2024-11-21 7.5 High
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.
CVE-2022-3072 1 Rosariosis 1 Rosariosis 2024-11-21 5.4 Medium
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3.
CVE-2022-2714 1 Rosariosis 1 Rosariosis 2024-11-21 9.8 Critical
Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.
CVE-2022-2067 1 Rosariosis 1 Rosariosis 2024-11-21 9.1 Critical
SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.
CVE-2022-2036 1 Rosariosis 1 Rosariosis 2024-11-21 5.4 Medium
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1.
CVE-2022-1997 1 Rosariosis 1 Rosariosis 2024-11-21 5.4 Medium
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.
CVE-2021-45416 1 Rosariosis 1 Rosariosis 2024-11-21 6.1 Medium
Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.
CVE-2021-44567 1 Rosariosis 1 Rosariosis 2024-11-21 9.8 Critical
An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php.
CVE-2021-44566 1 Rosariosis 1 Rosariosis 2024-11-21 5.4 Medium
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php.
CVE-2021-44565 1 Rosariosis 1 Rosariosis 2024-11-21 5.4 Medium
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields.
CVE-2021-44427 1 Rosariosis 1 Rosariosis 2024-11-21 9.8 Critical
An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
CVE-2020-15721 1 Rosariosis 1 Rosariosis 2024-11-21 6.1 Medium
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.
CVE-2020-15718 1 Rosariosis 1 Rosariosis 2024-11-21 6.1 Medium
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. A remote attacker could exploit this vulnerability using the include_inactive parameter in a crafted URL.
CVE-2020-15717 1 Rosariosis 1 Rosariosis 2024-11-21 6.1 Medium
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL.
CVE-2020-15716 1 Rosariosis 1 Rosariosis 2024-11-21 6.1 Medium
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remote attacker could exploit this vulnerability using the tab parameter in a crafted URL.
CVE-2020-13278 1 Rosariosis 1 Student Information System 2024-11-21 6.1 Medium
Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in a GET request.