CVE-2026-19785

MEDIUM 6.3

francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be launched remotely. Upgrading to version 12.8 is able to resolve this issue. The name of the patch is 6234a0ee0124c0667c824693ac77164f18946ddf. Upgrading the affected component is recommended.

CWE	CWE-89 CWE-74
Vendor	francoisjacquet
Product	rosariosis
Published	Aug 14, 2026

Stay Ahead of the Next One

Get instant alerts for francoisjacquet rosariosis

Be the first to know when new medium vulnerabilities affecting francoisjacquet rosariosis are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

francoisjacquet / RosarioSIS

12.7.0 12.7.1 12.7.2 12.7.3 12.7.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/389745 vuldb.com: https://vuldb.com/vuln/389745/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19785 vuldb.com: https://vuldb.com/submit/869377 github.com: https://github.com/francoisjacquet/rosariosis/issues/302 github.com: https://github.com/francoisjacquet/rosariosis/commit/6234a0ee0124c0667c824693ac77164f18946ddf github.com: https://github.com/francoisjacquet/rosariosis/releases/tag/v12.8 github.com: https://github.com/francoisjacquet/rosariosis/

Credits

🔍 Mitch311 (VulDB User)