CVE-2026-19784

MediumCVSS 4.3

Published: 14/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

A flaw was found in RosarioSIS up to version 12.8, affecting the DBUpdate function in Discipline/Referrals.php. This manipulation causes an authorization bypass. The attack can be initiated remotely, and the exploit has been published.

Risk Assessment

Risk of unauthorized access to disciplinary functions, potentially leading to data manipulation or system integrity compromise.

Recommendation

Upgrade the system to version 12.9 as soon as possible, which mitigates the issue (patch 04dd1a368ddf80ad7082baefa3c656e4e1825c76).

Original NVD description (English source)

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.