CVE-2021-45416

MediumCVSS 6.1

Published: 01/02/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.31%

81th percentile - higher than 81% of all known CVEs

Summary

A reflected XSS vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

Risk Assessment

The risk involves executing malicious scripts in the victim's browser, potentially leading to session theft, redirects, or sensitive data exfiltration.

Recommendation

Immediately update RosarioSIS to the latest version and implement input filtering and validation for the search_term parameter.

Original NVD description (English source)

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.