{"id":"CVE-2021-44565","aliases":["GHSA-44cg-qcpr-fwjh"],"url":"https://o3.security/vulnerability/CVE-2021-44565","summary":"Cross site scripting in francoisjacquet/rosariosis","details":"A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields.","published":"2022-02-24T15:15:24.107Z","modified":"2026-07-09T00:37:59.973801Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":{"score":0.0073,"percentile":0.51131,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"francoisjacquet/rosariosis","fixedVersion":"7.6.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md#changes-in-761"},{"type":"REPORT","url":"https://gitlab.com/francoisjacquet/rosariosis/-/issues/307"},{"type":"FIX","url":"https://gitlab.com/francoisjacquet/rosariosis/-/commit/0f5d1f1d193bc6b711d1644f172579d498ec1636"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T00:37:59.973801Z"}}