CVE-2021-45416 — Cross-site Scripting in Rosariosis

CWE-79 — Cross-site Scripting3 documents3 sources

Severity

6.1MEDIUMNVD

EPSS

23.1%

top 4.07%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Francoisjacquet Rosariosis Rosariosis

Timeline

PublishedFeb 1

Latest updateFeb 2

Description

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶Packagistfrancoisjacquet/rosariosis< 8.3

▶NVDrosariosis/rosariosis8.2.1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

OSV

RosarioSIS XSS Vulnerability↗2022-02-02

▶

GHSA

RosarioSIS XSS Vulnerability↗2022-02-02

▶