CVE-2026-121731 RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-121731?
CVE-2026-121731 is a high-severity vulnerability in francoisjacquet RosarioSIS, published on 3 Nov 2026.
Official description
RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.
Weakness: CWE-89
Which versions are affected by CVE-2026-121731?
How do I fix CVE-2026-121731?
No fix has been published for CVE-2026-121731 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-121731 being exploited?
There is no known exploitation of CVE-2026-121731 in the wild and no public exploit code.
Sources
Also known as GHSA-97v2-f3v8-3cfx.