CVE-2026-19784

MEDIUM 4.3

francoisjacquet RosarioSIS Referrals.php DBUpdate authorization

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.

CWE	CWE-639 CWE-285
Vendor	francoisjacquet
Product	rosariosis
Published	Aug 14, 2026

Stay Ahead of the Next One

Get instant alerts for francoisjacquet rosariosis

Be the first to know when new medium vulnerabilities affecting francoisjacquet rosariosis are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

francoisjacquet / RosarioSIS

12.0 12.1 12.2 12.3 12.4 12.5 12.6 12.7 12.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/389744 vuldb.com: https://vuldb.com/vuln/389744/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19784 vuldb.com: https://vuldb.com/submit/869367 github.com: https://github.com/francoisjacquet/rosariosis/issues/301 github.com: https://github.com/francoisjacquet/RosarioSIS/issues/301 github.com: https://github.com/francoisjacquet/RosarioSIS/commit/04dd1a368ddf80ad7082baefa3c656e4e1825c76 github.com: https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9 github.com: https://github.com/francoisjacquet/rosariosis/

Credits

🔍 Mitch311 (VulDB User)