Live › vulnerability › CVE-2026-116217
Go to dashboardRosarioSIS, a school information system, does not escape the menu_id and modname parameters in its Food Service menu reports page, so a crafted link injects an onmouseover handler into the page. A lured logged-in administrator's session and CSRF tokens can be stolen, letting the attacker act as that administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Any RosarioSIS deployment before 12.9.2 that exposes the Food Service module is exposed, since the flaw is in its menu reports page. The attack needs an administrator to open a crafted link while logged in, so deployments with no administrators using the web interface on the same network path carry less practical risk. Instances that do not run the Food Service module are not affected by this file.
No product ranges from the sources yet.
12.9.2 are affected.modules/Food_Service/MenuReports.php in the installation and confirm whether menu_id and modname are escaped on output.12.9.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu_id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menu_id injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-116217")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.