CVE-2021-45416

MediumPublished

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the...

Published: Feb 1, 2022
Updated: Jul 9, 2026
Assigning CNA: mitre
Evidence observed: Aug 25, 2026

Primary CVSS

6.1/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS probability estimate

2.3%

Low · next 30 days

Percentile: 82.6%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

Sources

CVE-2021-45416PoC
Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.
CVE-2021-45416PoC
Proof-of-concept demonstrating stored XSS in RosarioSIS 8.2.1 with Docker setup and step-by-step payload execution for security testing.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.