CVE-2026-19785

Name of the Vulnerable Software and Affected Versions RosarioSIS versions prior to 12.8

Description A SQL injection issue exists in the Student Medical Module within the modules/Students/includes/Medical.inc.php file. This flaw allows a remote attacker to execute unauthorized database queries by manipulating the table argument. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or modification of the database.

Recommendations Update to version 12.8. As a temporary mitigation, restrict access to the Student Medical Module until the update is applied.