GitHub Advisoryadvisory · Packagist

GHSA-287r-574x-f4h4 RosarioSIS XSS Vulnerability

MEDIUM Published 2022-02-02 Modified 2023-07-12 Official page ↗
Aliases
CVE-2021-45416
Ecosystem
Packagist
Packages
francoisjacquet/rosariosis
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2023-07-12

Affected packages

• Packagist francoisjacquet/rosariosis: < 8.3 → fixed in 8.3

Description

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

Related

Alias · CVE (1)

  • CVE-2021-45416 Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References