School Management System – WPSchoolPress, CVE-2023-4776
- CVE, Research URL
- Application
- Published on
- Oct 17, 2023
- Research Description
- The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.
- Affected versions
-
Min -, max 2.2.5.
- Status
-
vulnerable