CVE-2021-30114

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-04-08 · updated 2026-06-17
Weakness: CWE-352

Description

Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a voucher payment request through module/accounting/voucher/create. The application fails to validate the CSRF token for a POST request using admin privilege.

Affected products

Web-School Enterprise Resource Planning: 5.0

References

http://web-school.in
https://github.com/0xrayan/CVEs/issues/2
https://web-school.in/try-demo/
http://web-school.in
https://github.com/0xrayan/CVEs/issues/2
https://web-school.in/try-demo/

Get alerted when CVE-2021-30114 or the next vulnerability affects your stack