Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

orangehrm orangehrm vulnerabilities and exploits

(subscribe to this query)
4.3
CVSSv2
CVE-2012-1507
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM prior to 2.7 allow remote malicious users to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, o...
Orangehrm Orangehrm 2.6.0Orangehrm Orangehrm 2.6.0.1Orangehrm OrangehrmOrangehrm Orangehrm 2.6.2Orangehrm Orangehrm 2.6.9Orangehrm Orangehrm 2.6Orangehrm Orangehrm 2.6.11.3Orangehrm Orangehrm 2.6.12Orangehrm Orangehrm 2.6.7Orangehrm Orangehrm 2.6.8Orangehrm Orangehrm 2.6.8.1Orangehrm Orangehrm 2.6.11Orangehrm Orangehrm 2.6.11.2Orangehrm Orangehrm 2.6.5Orangehrm Orangehrm 2.6.6Orangehrm Orangehrm 2.6.1Orangehrm Orangehrm 2.6.10Orangehrm Orangehrm 2.6.3Orangehrm Orangehrm 2.6.4
6.5
CVSSv2
CVE-2012-1506
SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM prior to 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details...
Orangehrm Orangehrm 2.6.11.2Orangehrm Orangehrm 2.6.11.3Orangehrm Orangehrm 2.6.6Orangehrm Orangehrm 2.6.10Orangehrm Orangehrm 2.6.11Orangehrm Orangehrm 2.6.4Orangehrm Orangehrm 2.6.5Orangehrm Orangehrm 2.6.0.1Orangehrm Orangehrm 2.6.1Orangehrm Orangehrm 2.6.2Orangehrm Orangehrm 2.6.3Orangehrm Orangehrm 2.6.9Orangehrm Orangehrm 2.6.7Orangehrm Orangehrm 2.6Orangehrm Orangehrm 2.6.0Orangehrm Orangehrm 2.6.12Orangehrm OrangehrmOrangehrm Orangehrm 2.6.8Orangehrm Orangehrm 2.6.8.1
6.8
CVSSv2
CVE-2011-5259
SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM prior to 2.6.11.2 allows remote malicious users to execute arbitrary SQL commands via the id parameter.
Orangehrm Orangehrm 2.6.5Orangehrm Orangehrm 2.6.4Orangehrm Orangehrm 2.6.10Orangehrm Orangehrm 2.6.3Orangehrm Orangehrm 2.6.2Orangehrm Orangehrm 2.6.8Orangehrm Orangehrm 2.6.7Orangehrm Orangehrm 2.6.6Orangehrm Orangehrm 2.6.0.1Orangehrm OrangehrmOrangehrm Orangehrm 2.6.9Orangehrm Orangehrm 2.6.8.1Orangehrm Orangehrm 2.6.1Orangehrm Orangehrm 2.6.0
4.3
CVSSv2
CVE-2011-5258
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM prior to 2.6.11.2 allow remote malicious users to inject arbitrary web script or HTML via the (1) uniqcode or (2) isAdmin parameter to index.php; or the (3) PATH_INFO to lib/controllers/centralcontroller.php.
Orangehrm Orangehrm 2.6.7Orangehrm Orangehrm 2.6.6Orangehrm Orangehrm 2.6.0.1Orangehrm OrangehrmOrangehrm Orangehrm 2.6.5Orangehrm Orangehrm 2.6.4Orangehrm Orangehrm 2.6.8.1Orangehrm Orangehrm 2.6.8Orangehrm Orangehrm 2.6.1Orangehrm Orangehrm 2.6.0Orangehrm Orangehrm 2.6.10Orangehrm Orangehrm 2.6.9Orangehrm Orangehrm 2.6.3Orangehrm Orangehrm 2.6.2
5
CVSSv2
CVE-2007-5931
The reDirect function in lib/controllers/RepViewController.php in OrangeHRM prior to 2.2.2 does not verify the privileges of a user, which allows remote malicious users to obtain access to data via unspecified vectors. NOTE: the provenance of this information is unknown; the deta...
Orangehrm Orangehrm
6.5
CVSSv2
CVE-2019-12839
In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated malicious users to achieve arbitrary command execution.
Orangehrm Orangehrm
4.3
CVSSv2
CVE-2014-100021
Cross-site scripting (XSS) vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM prior to 3.1.2 allows remote malicious users to inject arbitrary web script or HTML via the empsearch[employee_name][empId] parameter.
Orangehrm Orangehrm
5.5
CVSSv2
CVE-2020-29437
SQL injection in the Buzz module of OrangeHRM up to and including 4.6 allows remote authenticated malicious users to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint.
Orangehrm Orangehrm
3.5
CVSSv2
CVE-2022-28985
A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows malicious users to execute arbitrary web scripts or HTML via a crafted POST request.
Orangehrm Orangehrm 4.10.1
3.5
CVSSv2
CVE-2013-1353
Orange HRM 2.7.1 allows XSS via the vacancy name.
Orangehrm Orangehrm 2.7.1
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322CVE-2006-4304wirelessCVE-2023-23022local file inclusionCVE-2024-27058CVE-2024-33820open redirectCVE-2024-27079
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook