CVE-2023-29918

RosarioSIS vulnerable to CSV Injection

5.4 MediumPublic exploit

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

2.17%Up 2.1 points since May 3, 2023

What each source reports

NVD Score used 5.4

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

Record: CVE-2023-29918
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-1236
Updated: 2026-11-02

CVE List 5.4

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

Record: CVE-2023-29918
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-1236
Updated: 2026-11-02

EUVDEUVD-2023-1530 5.4

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

Record: EUVD-2023-1530
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f8hp-grmr-pp7j 5.4

RosarioSIS vulnerable to CSV Injection

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

Record: GHSA-f8hp-grmr-pp7j
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-1236
Updated: 2026-11-02

OSV 5.4

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

Record: CVE-2023-29918
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-f8hp-grmr-pp7j 5.4

RosarioSIS vulnerable to CSV Injection

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

Record: GHSA-f8hp-grmr-pp7j
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-1236
Updated: 2026-11-02

Affected products

rosariosis

Affected packages

Affected packages
Package	Affected	Fixed
`francoisjacquet/rosariosis` Packagist	through 10.8.4	None known
`francoisjacquet/rosariosis` Packagist	through 10.8.4, plus listed versions v10.1v10.2v10.2.1v10.2.2v10.2.3 Show 45 moreShow less v10.3v10.3.1v10.3.2v10.3.3v10.4v10.4.1v10.4.2v10.4.3v10.4.4v10.5v10.5.1v10.5.2v10.6v10.6.1v10.6.2v10.6.3v10.7v10.7.1v10.8v10.8.1v10.8.2v10.8.3v10.8.4v5.0v5.0-beta3v5.0-beta4v5.0.1v5.0.2v5.0.3v5.0.4v5.0.5v5.1v5.1-betav5.1.1v5.2v5.2-betav5.3v5.3-betav5.3.1v5.3.2v5.3.3v5.3.4v5.4v5.4-betav5.4.1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	RosarioSIS 10.8.4 - CSV Injection	2023-07-28

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-29918 is a medium vulnerability (CVSS 5.4) in Rosariosis, published May 2, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.17%, the 82nd percentile. No source names a fixed version.

References

This page doesn't list everything

Left out here: 138 versions. The JSON record has them.