# CVE-2026-19785: francoisjacquet RosarioSIS SQL injection in Student Medical Module

Source: https://junglewise.ai/threats/cve-2026-19785-francoisjacquet-rosariosis-sql-injection-in-student-medical  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19785 · Severity: medium · CVSS 6.3 · Published 2026-08-14

RosarioSIS is a student information system used by schools for managing student records and operations. An attacker can inject malicious SQL code through the student medical records module, potentially allowing them to read, modify, or delete sensitive student health information and other database records remotely without authentication.

Technologies: [Francoisjacquet RosarioSIS](https://junglewise.ai/threats/technologies/rosariosis). Vendors: [Francoisjacquet](https://junglewise.ai/threats/vendors/francoisjacquet).

## Quick answers

**Is CVE-2026-19785 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19785 being exploited in the wild.

**How severe is CVE-2026-19785?** Medium severity, with a CVSS score of 6.3, published 14 August 2026.

**Which products and versions are affected?** Francoisjacquet RosarioSIS up to 12.7.4.

**Is there a fix for CVE-2026-19785?** A patch was published on 2026: Version 12.8 includes the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19785 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-19785?** Check whether you run Francoisjacquet RosarioSIS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the Student Medical Module (modules/Students/includes/Medical.inc.php) of RosarioSIS versions up to 12.7.4. The vulnerability is triggered through unsanitized manipulation of the 'table' parameter in HTTP requests, allowing an attacker to execute arbitrary SQL commands against the application database. The attack is network-accessible and does not require authentication. An attacker can query, modify, or delete database records depending on database permissions. The vulnerability was patched in version 12.8 (commit 6234a0ee0124c0667c824693ac77164f18946ddf).

## Affected products

- francoisjacquet RosarioSIS up to 12.7.4

## Timeline

- 2026-08-14: disclosed
- 2026: patched: Version 12.8 includes the fix

## References

- [https://github.com/francoisjacquet/rosariosis/](https://github.com/francoisjacquet/rosariosis/)
- [https://github.com/francoisjacquet/rosariosis/commit/6234a0ee0124c0667c824693ac77164f18946ddf](https://github.com/francoisjacquet/rosariosis/commit/6234a0ee0124c0667c824693ac77164f18946ddf)

## Related threats

- [francoisjacquet RosarioSIS cross-site request forgery in Modules.php](https://junglewise.ai/threats/cve-2026-19786-francoisjacquet-rosariosis-cross-site-request-forgery-in-modules)
- [francoisjacquet RosarioSIS IDOR in save/delete operations](https://junglewise.ai/threats/cve-2026-19784-francoisjacquet-rosariosis-idor-in-save-delete-operations)