Live › vulnerability › CVE-2026-116010
Go to dashboardRosarioSIS before 12.9.1 lets an authenticated teacher submit arbitrary student IDs to several forms, so they can create referrals, eligibility codes, attendance and final grades for any student in the school. The attacker gets unauthorized write access to student records from a normal teacher account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.
Schools running RosarioSIS before 12.9.1 where teachers have login accounts. Exposure depends on teachers being able to reach MakeReferral.php, EnterEligibility.php, InputFinalGrades.php or TakeAttendance.php, which is the default for teacher accounts. Installations already on 12.9.1 or later are not affected.
No product ranges from the sources yet.
12.9.112.9.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.
This page as .md · .json · in your agent: get_signal("CVE-2026-116010")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.