{"id":"CVE-2021-44427","aliases":["GHSA-wf5p-f5xr-c4jj"],"url":"https://o3.security/vulnerability/CVE-2021-44427","summary":"SQL Injection in rosariosis","details":"An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.","published":"2021-11-29T22:15:07.533Z","modified":"2026-07-09T01:08:01.988930Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.50641,"percentile":0.98867,"asOf":"2026-08-29"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"francoisjacquet/rosariosis","fixedVersion":"8.1.1"}],"fix":{"url":"https://github.com/francoisjacquet/rosariosis/commit/e001430aa9fb53d2502fb6f036f6c51c578d2016","label":"francoisjacquet/rosariosis@e001430"},"references":[{"type":"REPORT","url":"https://gitlab.com/francoisjacquet/rosariosis/-/issues/328"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44427"},{"type":"WEB","url":"https://github.com/francoisjacquet/rosariosis/commit/e001430aa9fb53d2502fb6f036f6c51c578d2016"},{"type":"PACKAGE","url":"https://github.com/francoisjacquet/rosariosis"},{"type":"WEB","url":"https://gitlab.com/francoisjacquet/rosariosis/-/commit/e001430aa9fb53d2502fb6f036f6c51c578d2016"},{"type":"WEB","url":"https://gitlab.com/francoisjacquet/rosariosis/blob/mobile/CHANGES.md#changes-in-811"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T01:08:01.988930Z"}}