CVE-2026-121731High· 8.8▾ TwilightRosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.
RosarioSIS < 12.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121732Low· 2.7RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment
CVE-2026-116217Medium· 6.1RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php
CVE-2026-116010Medium· 4.3RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers
CVE-2026-93014High· 7.1RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal
CVE-2021-45416Medium· 6.1Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.
CVE-2025-10079High· 7.3A flaw has been found in PHPGurukul Small CRM 4.0