Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-24663

Simple School Staff Directory <= 1.1 - Admin+ Arbitrary File Upload

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Simple Schools Staff Directory

  • 1.1 to ≤ 1.1affected

References