CVE-2020-15717

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL.

• CWE-79

• https://exchange.xforce.ibmcloud.com/vulnerabilities/184943VDB Entry
• https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.mdRelease Notes, Third Party Advisory
• https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975aPatch, Third Party Advisory
• https://gitlab.com/francoisjacquet/rosariosis/-/issues/291Broken Link
• https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-betaThird Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/184943VDB Entry
• https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.mdRelease Notes, Third Party Advisory
• https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975aPatch, Third Party Advisory
• https://gitlab.com/francoisjacquet/rosariosis/-/issues/291Broken Link
• https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-betaThird Party Advisory

Published

Jul 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15711In MISP before 2.4.129, setting a favourite homepage was not…8.8
• CVE-2020-15712rConfig 3.9.5 could allow a remote authenticated attacker to…4.3
• CVE-2020-15713rConfig 3.9.5 is vulnerable to SQL injection. A remote authe…8.8
• CVE-2020-15714rConfig 3.9.5 is vulnerable to SQL injection. A remote authe…8.8
• CVE-2020-15715rConfig 3.9.5 could allow a remote authenticated attacker to…9.9
• CVE-2020-15716RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper va…6.1
• CVE-2020-15718RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper va…6.1
• CVE-2020-15719libldap in certain third-party OpenLDAP packages has a certi…4.2
• CVE-2020-15720In Dogtag PKI through 10.8.3, the pki.client.PKIConnection c…6.8
• CVE-2020-15721RosarioSIS through 6.8-beta allows modules/Custom/NotifyPare…6.1
• CVE-2020-15722In version 12.1.0.1004 and below of 360 Total Security,when …7.8
• CVE-2020-15723In the version 12.1.0.1004 and below of 360 Total Security, …7.8