medium6.1
CVE-2021-45416
RosarioSIS XSS Vulnerability
Impact
Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | francoisjacquet/rosariosis | <= 8.2.1 | 8.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rosariosis | Rosariosis | Version 8.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/86x/CVE-2021-45416
- https://github.com/advisories/GHSA-287r-574x-f4h4
- https://nvd.nist.gov/vuln/detail/CVE-2021-45416
- http://rosariosis.com
- https://gitlab.com/francoisjacquet/rosariosis/-/commit/aec018065ca12ecef03ee454a8112f992ea35315
- https://www.youtube.com/watch?v=PvFUxSGpWpY