Vulnerabilities > CVE-2022-2381 - Unspecified vulnerability in E Unlocked - Student Result Project E Unlocked - Student Result 1.0.4

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
e-unlocked-student-result-project

Summary

The E Unlocked - Student Result WordPress plugin through 1.0.4 is lacking CSRF and validation when uploading the School logo, which could allow attackers to make a logged in admin upload arbitrary files, such as PHP via a CSRF attack