CVE-2020-15716

MEDIUM

Rosariosis - XSS

Title source: rule

Description

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remote attacker could exploit this vulnerability using the tab parameter in a crafted URL.

Exploits (1)

exploitdb WORKING POC

by CodeSecLab · textwebappsphp

https://www.exploit-db.com/exploits/52450

View Code ZIP pw:eip

References (6)

[Various Sources] https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-15716.md

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/184942

[Release Notes, Third Party Advisory] https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md

[Patch, Third Party Advisory] https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975a

[Broken Link] https://gitlab.com/francoisjacquet/rosariosis/-/issues/291

[Third Party Advisory] https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-beta

Scores

CVSS v3 6.1

EPSS 0.0149

EPSS Percentile 81.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

rosariosis/rosariosis 6.7.2

Published Jul 15, 2020

Tracked Since Feb 18, 2026