PT-2026-123326
CVE-2026-116217
·
Published
2026-10-26
·
Updated
2026-10-26
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menu id injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.
Found an issue in the description? Have something to add? Feel free to write us 👾