CVE-2023-2665

< 11.0

Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.

7.5HIGH

CVE-2023-29918

all versions

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

5.4MEDIUM

CVE-2023-2202

< 10.9.3

Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.

6.5MEDIUM

CVE-2023-0994

< 10.8.2

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.

7.5HIGH

CVE-2022-2714

< 10.1

Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.

9.8CRITICAL

CVE-2022-3072

< 8.9.3

Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3.

5.4MEDIUM

CVE-2022-2067

< 9.0

SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.

9.1CRITICAL

CVE-2022-2036

< 9.0.1

Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1.

5.4MEDIUM

CVE-2022-1997

< 9.0

Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.

5.4MEDIUM

CVE-2021-44567

< 7.6.1

An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/Porta

9.8CRITICAL

CVE-2021-44566

< 4.3

A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/M

5.4MEDIUM

CVE-2021-44565

< 7.6.1

A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, w

5.4MEDIUM

CVE-2021-45416

all versions

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_te

6.1MEDIUM

CVE-2021-44427

< 8.1.1

An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote a

9.8CRITICAL

CVE-2020-13278

< 6.5.1

Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attacke

6.1MEDIUM

CVE-2020-15718

all versions

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. A re

6.1MEDIUM

CVE-2020-15717

all versions

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote

6.1MEDIUM

CVE-2020-15716

all versions

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remot

6.1MEDIUM

CVE-2020-15721

<= 6.7.2

RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and Use

6.1MEDIUM