{"id":"CVE-2021-44427","aliases":["GHSA-wf5p-f5xr-c4jj"],"url":"https://o3.security/vulnerability/CVE-2021-44427","summary":"SQL Injection in rosariosis","details":"An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.","published":"2021-11-29T22:15:07.533Z","modified":"2026-07-09T01:08:01.988930Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"francoisjacquet/rosariosis","fixedVersion":"8.1.1"}],"fix":null,"references":[{"type":"REPORT","url":"https://gitlab.com/francoisjacquet/rosariosis/-/issues/328"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T01:08:01.988930Z"}}