~ / search / GHSA-6vc5-v7hw-h5h2

GHSA-6vc5-v7hw-h5h2

Cross-site Scripting in RosarioSIS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-15721

Packages

EcosystemPackageAffectedFixed in
Packagist francoisjacquet/rosariosis < 6.8 6.8

Details

As written in the advisory (Markdown source, shown as plain text).

RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.

References

External links from the advisory. They lead to third-party sites.