CVE-2026-116010

Name of the Vulnerable Software and Affected Versions RosarioSIS versions prior to 12.9.1

Description Authenticated teachers can write records for students outside their assigned course period by providing arbitrary student IDs. This is possible by modifying the st arr, values, or attendance POST arrays within the following endpoints: 'MakeReferral.php', 'EnterEligibility.php', 'InputFinalGrades.php', and 'TakeAttendance.php'. This allows the creation of referrals, eligibility codes, attendance records, and final grades for any student in the school.

Recommendations Update RosarioSIS to version 12.9.1 or later.