CVE-2024-4823: Arox School ERP Pro+responsive

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the index '/schoolerp/office_admin/' in the parameters es_bankacc, es_bank_name, es_bank_pin, es_checkno, es_teller_number, dc1 and dc2. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session.

Affected products

• Arox School ERP Pro+responsive: version 1.0 only

Published 2024-05-14. Last modified 2026-06-17.