CVE

CVE-2020-15718

6.1

CVSS

Description

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. A remote attacker could exploit this vulnerability using the include_inactive parameter in a crafted URL.

Attack Vector

Privileges Req.

User Interaction

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumWeb Vulnerabilities~10 seconds

RosarioSIS 6.7.2 - Cross-Site Scripting

RosarioSIS version 6.7.2 and earlier contains a reflected cross-site scripting (XSS) vulnerability in the Preferences module. The 'tab' parameter in Modules.php is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code via a crafted URL. Remediation: Update RosarioSIS to the latest version where input validation has been improved.

url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →