Medium 6.1Published Oct 26, 2026

CVE-2026-116217RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php

Updated under an hour ago (Oct 30, 2026, 4:23 AM ET)

Does this affect you?

It affects francoisjacquet rosariosis. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for francoisjacquet rosariosis Exploited in the last 30 days

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu_id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menu_id injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.

CVSS: 6.1 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 26, 2026

Affected products

Affected products

francoisjacquet rosariosis francoisjacquet:rosariosis (from the name)	before 12.9.2; 12.9.2 not affected	CNA record

References

References

https://github.com/francoisjacquet/rosariosis/commit/08c871da7f9d8478e0e72d104b310b98630fc755	patch
https://gitlab.com/francoisjacquet/rosariosis/-/commit/08c871da7f9d8478e0e72d104b310b98630fc755	patch
https://github.com/francoisjacquet/rosariosis/blob/v12.9.1/modules/Food_Service/MenuReports.php#L315	technical-description
https://github.com/francoisjacquet/rosariosis	product
https://www.vulncheck.com/advisories/rosariosis-before-12.9.2-reflected-xss-via-menu-id-in-menureports-php	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.