Live › vulnerability › CVE-2026-121731
RosarioSIS is an open-source school information system. Before version 12.9, an unquoted period_id parameter in StudentSummary.php lets any authenticated non-student user, including parents, inject SQL and extract administrator password hashes and student records or modify data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Schools and organisations running RosarioSIS before 12.9 with parent or other non-student accounts are exposed, since those accounts can reach the vulnerable page. Installations limited to student or administrator-only access still need to be checked against the patched version. unknown whether other configurations change exposure.
No product ranges from the sources yet.
12.9.StudentSummary.php in the installation and confirm whether it handles period_id without quoting.12.9 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.
This page as .md · .json · in your agent: get_signal("CVE-2026-121731")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.