SQL Injection Vulnerability in RosarioSIS Student Medical Module by francoisjacquet
CVE-2026-19785

5.3MEDIUM

Key Information:

Vendor

Francoisjacquet

Status
RosariOSis
Vendor
CVE Published:
14 August 2026

What is CVE-2026-19785?

A SQL injection vulnerability exists in the Student Medical Module of RosarioSIS versions up to 12.7.4, specifically in the Medical.inc.php file located in the modules/Students/includes directory. Attackers can exploit this vulnerability by manipulating input parameters, potentially allowing for remote database queries and unauthorized access to sensitive information. It is advised to update to version 12.8, which includes a patch to fix this issue. The patch ID is 6234a0ee0124c0667c824693ac77164f18946ddf.

Affected Version(s)

RosarioSIS 12.7.0

RosarioSIS 12.7.1

RosarioSIS 12.7.2

References

https://vuldb.com/vuln/389745
vdb-entrytechnical-description
https://vuldb.com/vuln/389745/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19785
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mitch311 (VulDB User)
.