Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| francoisjacquet | RosarioSIS | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sat, 24 Oct 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school. | |
| Title | RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers | |
| First Time appeared |
Rosariosis
Rosariosis rosariosis |
|
| Weaknesses | CWE-639 | |
| CPEs | cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Rosariosis
Rosariosis rosariosis |
|
| References |
|
|
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-24T11:40:29.488Z
Reserved: 2026-10-24T11:23:53.806Z
Link: CVE-2026-116010
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.