CVE-2020-8504 (v3: 6.5)
31 Jan 2020
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.