CVE-2021-30113

Name of the Vulnerable Software and Affected Versions Web-School ERP version 5.0

Description A blind XSS issue exists, allowing an attacker to inject JavaScript code into the event name and description fields via the Add Events feature. This code is stored on the page and executed when a visitor views the event, potentially sending the victim's information to the attacker's website.

Recommendations For Web-School ERP version 5.0, consider disabling the Add Events feature or restricting access to it until a fix is available. As a temporary workaround, restrict the ability to inject JavaScript code into the event name and description fields to minimize the risk of exploitation.