CVE-2026-121731
8.8 HIGHpublic exploit availablePublished 2026-11-03 · Updated 2026-11-03
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Public exploit & PoC references
- https://github.com/francoisjacquet/rosariosis
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Attendance/includes/StudentSummary.php#L119
- https://github.com/francoisjacquet/rosariosis/commit/1b809f9761b50c3f6faf9e1b2b5f5e74d63509c1
- https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9
All references
- https://github.com/francoisjacquet/rosariosis
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Attendance/includes/StudentSummary.php#L119
- https://github.com/francoisjacquet/rosariosis/commit/1b809f9761b50c3f6faf9e1b2b5f5e74d63509c1
- https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9
- https://gitlab.com/francoisjacquet/rosariosis/-/issues/375
- https://www.vulncheck.com/advisories/rosariosis-before-12.9-sql-injection-via-period-id-in-attendance-absence-report
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2015-20122
- HIGHCVE-2015-20128PoC
- HIGHCVE-2019-25776PoC
- HIGHCVE-2019-25778PoC
- HIGHCVE-2021-48008
- HIGHCVE-2022-4997
- HIGHCVE-2022-51021PoC
- HIGHCVE-2022-51023PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.