The SQL Injection vulnerability exists in RosarioSIS 7.6 through the 'votes' parameter. By manipulating the 'votes' parameter in the POST request, an attacker can inject malicious SQL queries. This can lead to unauthorized access to the database, data manipulation, and potentially further exploitation of the system. This vulnerability has been assigned the CVE identifier CVE-2021-44567.