https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T06:27:27.041358+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-370753 EUVD-2026-370753 2026-10-05T06:27:27.096444+00:00 EUVD-2026-370753 https://cve.radiocsirt.org/vuln/fkie_cve-2026-93014 fkie_cve-2026-93014 2026-10-05T06:27:27.096482+00:00

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.

 https://cve.radiocsirt.org/vuln/ghsa-qmmf-hm9j-j4mj GHSA-qmmf-hm9j-j4mj 2026-10-05T06:27:27.096518+00:00

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.