CVE-2022-2312

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make logged in user with a role as low as contributor to add/edit and delete students via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site scripting

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-352 CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Aug 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-231207.8A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could all CVE-2022-231219.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required t CVE-2022-231229.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required t CVE-2022-231239.8This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not re CVE-2022-231249.8This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not re CVE-2022-231259.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required t CVE-2022-231269.8TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Drivin CVE-2022-231276.1Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions CVE-2022-231289.8Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), CVE-2022-231295.5Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS6 CVE-2022-23137.3A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and o CVE-2022-231305.5Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64 versions 10.97 and p