MEDIUM6.1
GHSA-6vc5-v7hw-h5h2
Cross-site Scripting in RosarioSIS
Quick fix
GHSA-6vc5-v7hw-h5h2 — francoisjacquet/rosariosis: upgrade to the fixed version with the command below.
composer require francoisjacquet/rosariosis:^6.8Details
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/francoisjacquet/rosariosis
Introduced in:
0Fixed in: 6.8Fix
composer require francoisjacquet/rosariosis:^6.8