CVE-2021-45416

RosarioSIS XSS Vulnerability

6.1 MediumPublic exploitFix available

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

2.33%Down 0.4 points since Feb 2, 2022

What each source reports

NVD Score used 6.1

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

Record: CVE-2021-45416
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

Record: CVE-2021-45416
Updated: 2026-11-02

EUVDEUVD-2022-0758 No score

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

Record: EUVD-2022-0758
Updated: 2026-11-02

GitHub AdvisoriesGHSA-287r-574x-f4h4 No score

RosarioSIS XSS Vulnerability

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

Record: GHSA-287r-574x-f4h4
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

Record: CVE-2021-45416
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-287r-574x-f4h4 No score

RosarioSIS XSS Vulnerability

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

Record: GHSA-287r-574x-f4h4
Weakness: CWE-79
Updated: 2026-11-02

Affected products

rosariosis

Affected packages

Affected packages
Package	Affected	Fixed
`francoisjacquet/rosariosis` Packagist	through 8.2.1	8.3
`francoisjacquet/rosariosis` Packagist	before 8.3, plus listed versions v5.0v5.0-beta3v5.0-beta4v5.0.1v5.0.2 Show 45 moreShow less v5.0.3v5.0.4v5.0.5v5.1v5.1-betav5.1.1v5.2v5.2-betav5.3v5.3-betav5.3.1v5.3.2v5.3.3v5.3.4v5.4v5.4-betav5.4.1v5.4.2v5.4.3v5.4.4v5.4.5v5.4.6v5.4.7v5.5v5.5-betav5.5-beta2v5.5-beta3v5.5.1v5.5.2v5.5.3v5.5.4v5.6v5.6-betav5.6.1v5.6.2v5.6.3v5.6.4v5.6.5v5.7v5.7.1v5.7.2v5.7.3v5.7.4v5.7.5v5.7.6	8.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	86x/CVE-2021-45416	2022-01-27
PoC in GitHub	dnr6419/CVE-2021-45416	2022-02-14

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-45416 is a medium vulnerability (CVSS 6.1) in Rosariosis, published February 1, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.33%, the 83rd percentile. Fixed in francoisjacquet/rosariosis 8.3.

References

This page doesn't list everything

Left out here: 86 versions. The JSON record has them.