/Vulnerability Library

RosarioSIS 6.7.2 - Cross-Site Scripting

CVE-2020-15718
Verified

Description

RosarioSIS version 6.7.2 and earlier contains a reflected cross-site scripting (XSS) vulnerability in the Preferences module. The 'tab' parameter in Modules.php is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code via a crafted URL.

Severity

Medium

CVSS Score

6.1

Exploit Probability

6%

Affected Product

rosariosis

Published Date

February 13, 2026

Template Author

0xr2r, jarvis-survives

CVE-2020-15718.yaml
6.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2020-15718
CWE ID:
cwe-79

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/184944https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-15718.mdhttps://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.mdhttps://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975a

Remediation Steps

Update RosarioSIS to the latest version where input validation has been improved.