CVE-2022-2312
Medium
Description
The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make logged in user with a role as low as contributor to add/edit and delete students via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site scripting
SeverityMedium
CVSS5.4
Exploit probability—
ProductStudent Result Or Employee Database
PublishedAug 22, 2022
First seenAug 22, 2022
How to fix
Update
- student_result_or_employee_database_project student_result_or_employee_database1.7.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| student_result_or_employee_database_project student_result_or_employee_database | v < 1.7.5 | 1.7.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.