Orangehrm vulnerabilities

Products

• Orangehrm 31

Newest

• orangehrm OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure CVE-2026-39349 2.1 LowApril 7, 2026
• orangehrm OrangeHRM is Missing Authorization Checks in AbstractFileController Subclasses Expose Job Specification and Vacancy Attachments CVE-2026-39348 5.3 MediumApril 7, 2026
• orangehrm OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion CVE-2026-39347 5.1 MediumApril 7, 2026
• orangehrm OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding CVE-2026-39346 5.3 MediumApril 7, 2026
• orangehrm OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader CVE-2026-39345 4.6 MediumApril 7, 2026
• orangehrm OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments CVE-2025-66291 5.3 MediumNovember 29, 2025
• orangehrm OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachments CVE-2025-66290 5.3 MediumNovember 29, 2025
• orangehrm OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change CVE-2025-66289 8.7 HighNovember 29, 2025
• orangehrm OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow CVE-2025-66225 8.7 HighNovember 29, 2025
• orangehrm OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection CVE-2025-66224 Public exploit 9.0 CriticalNovember 29, 2025
• orangehrm An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via the UserService.php and... CVE-2025-44040 Disputed 7.2 HighMay 21, 2025
• orangehrm OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection. CVE-2024-36428 8.1 HighMay 27, 2024
• orangehrm A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10... CVE-2022-28985 6.3 MediumMay 20, 2022
• orangehrm OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint. CVE-2022-27110 5.4 MediumApril 6, 2022
• orangehrm OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability. CVE-2022-27109 5.4 MediumApril 6, 2022
• orangehrm OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony... CVE-2022-27108 4.3 MediumApril 6, 2022
• orangehrm OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via... CVE-2022-27107 5.4 MediumApril 6, 2022
• orangehrm OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address... CVE-2021-28399 5.3 MediumApril 26, 2021
• orangehrm SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers... CVE-2020-29437 8.1 HighJanuary 5, 2021
• orangehrm Orange HRM 2.7.1 allows XSS via the vacancy name. CVE-2013-1353 5.4 MediumFebruary 10, 2020
• orangehrm In OrangeHRM 4.3.1 and before, there is an input validation error within admin... CVE-2019-12839 8.8 HighJune 15, 2019
• orangehrm Cross-site scripting (XSS) vulnerability in symfony/web/index.php/pim/viewEmployeeList in... CVE-2014-100021 4.3 MediumJanuary 13, 2015
• orangehrm Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote... CVE-2012-1507 Public exploit 4.3 MediumSeptember 17, 2014
• orangehrm SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in... CVE-2012-1506 Public exploit 6.5 MediumSeptember 17, 2014
• orangehrm SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2... CVE-2011-5259 Public exploit 6.8 MediumFebruary 12, 2013
• orangehrm Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote... CVE-2011-5258 Public exploit 4.3 MediumFebruary 12, 2013
• orangehrm Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated... CVE-2012-5367 Public exploit 6.0 MediumDecember 3, 2012
• orangehrm OrangeHRM 2.6.0.2 allows remote attackers to obtain sensitive information via a direct request to... CVE-2011-3766 5.0 MediumSeptember 24, 2011
• orangehrm Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote attackers to... CVE-2010-4798 Public exploit 6.8 MediumApril 27, 2011
• orangehrm The reDirect function in lib/controllers/RepViewController.php in OrangeHRM before 2.2.2 does not... CVE-2007-5931 5.0 MediumNovember 10, 2007
• orangehrm Multiple unspecified vulnerabilities in the Login page in OrangeHRM before 20070212 have unknown... CVE-2007-1193 9.3 HighMarch 2, 2007