CVE-2026-116217 RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116217?
CVE-2026-116217 is a medium-severity vulnerability in francoisjacquet rosariosis, published on 26 Oct 2026.
Official description
RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu_id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menu_id injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.
Weakness: CWE-79
Which versions are affected by CVE-2026-116217?
How do I fix CVE-2026-116217?
No fix has been published for CVE-2026-116217 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116217 being exploited?
There is no known exploitation of CVE-2026-116217 in the wild and no public exploit code.
Sources
Also known as GHSA-p567-rgff-v7fc.