CVE-2021-30112: Web-School Enterprise Resource Planning

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a student_leave_application request through module/core/studentleaveapplication/create. The application fails to validate the CSRF token for a POST request using Guardian privilege.

Affected products

• Web-School Enterprise Resource Planning: version 5.0 only

Published 2021-04-08. Last modified 2026-06-17.