CVE-2022-2381

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The E Unlocked - Student Result WordPress plugin through 1.0.4 is lacking CSRF and validation when uploading the School logo, which could allow attackers to make a logged in admin upload arbitrary files, such as PHP via a CSRF attack

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Aug 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-238106.5Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series vers CVE-2022-238129.8This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in CVE-2022-238135.3The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest me CVE-2022-238145.3Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confide CVE-2022-238158.2Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB entry, potentially le CVE-2022-238177.3Insufficient checking of memory buffer in AMD Secure Processor (ASP) Secure OS may allow an attacker with a malicious trusted application to CVE-2022-238187.5Insufficient input validation on the model specific register: VM_HSAVE_PA may potentially lead to loss of SEV-SNP guest memory integrity.CVE-2022-23824.3The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, CVE-2022-238209.8Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execut CVE-2022-238219.8Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code exec CVE-2022-238226.8In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication an CVE-2022-238236.5A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to p