Is there a patch available for EUVD-2026-58569?

Yes, a patch is available for EUVD-2026-58569. Update the affected software to the latest version immediately.

RosarioSIS EUVD-2026-58569

Q: What is the CVSS score of EUVD-2026-58569?

EUVD-2026-58569 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-19785 MEDIUM

SQL Injection (CWE-89)

2026-08-14 VulDB

GHSA-4g9f-3jh3-h27m

PHP SQLi Rosariosis Francoisjacquet

5.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Authentication with low privileges required to access the Medical module; no confidentiality exfiltration path evident - only integrity and availability impacts apply.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 14, 2026 - 03:46 vuln.today

Analysis Generated

Aug 14, 2026 - 03:46 vuln.today

CVE Published

Aug 14, 2026 - 02:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be launched remotely. Upgrading to version 12.8 is able to resolve this issue. The name of the patch is 6234a0ee0124c0667c824693ac77164f18946ddf. Upgrading the affected component is recommended.

AnalysisAI

Arbitrary database table row deletion in RosarioSIS up to version 12.7.4 allows authenticated users to issue DELETE statements against any table in the database by manipulating the unsanitized table parameter in modules/Students/includes/Medical.inc.php. While DBEscapeIdentifier() prevents classic SQL injection syntax escapes, it does not restrict which table is targeted - enabling destruction of records far beyond the medical module's intended scope, including user accounts, grades, or other critical school data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 12.8.

Technical ContextAI

RosarioSIS is an open-source PHP-based school information system. The vulnerable code in modules/Students/includes/Medical.inc.php constructs a DELETE SQL query by directly embedding $_REQUEST['table'] (wrapped in DBEscapeIdentifier()) and (int) $_REQUEST['id'] without validating which table is permissible. CWE-89 (SQL Injection) governs this class of flaw; more precisely, the identifier escaping function prevents classical injection breakout but does not restrict the attacker's choice of target table, making this an unvalidated direct SQL object reference. The integer cast on the id parameter correctly neutralizes injection there. The fix (commit 6234a0ee) introduces an allowlist of three permitted table names - student_medical_alerts, student_medical, and student_medical_visits - rejecting all other values before the query executes. Affected CPE: cpe:2.3:a:francoisjacquet:rosariosis:*:*:*:*:*:*:*:* covering all versions up to 12.7.4.

RemediationAI

Upgrade RosarioSIS to version 12.8 or later, which contains the fix from commit 6234a0ee0124c0667c824693ac77164f18946ddf available at https://github.com/francoisjacquet/rosariosis/releases/tag/v12.8. If immediate upgrade is not feasible, restrict access to the Student Medical Module to the minimum set of trusted staff accounts using RosarioSIS's built-in role and permission controls, reducing the pool of principals who can trigger the vulnerable endpoint. Additionally, consider deploying a web application firewall rule to block requests to Medical.inc.php that contain a table parameter value not in the known-good list (student_medical_alerts, student_medical, student_medical_visits); note this may require tuning to avoid blocking legitimate operations and does not replace patching. For internet-facing deployments, restricting application access to internal networks or VPN reduces remote exposure. No side effects are anticipated from upgrading to 12.8 beyond normal regression testing for the medical module workflow.