orangehrm

Records31All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

orangehrm records in CISA KEV

No orangehrm vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Orangehrm 31 records HIGH

Records

31 records

TI-2024-24213 CVE-2024-36428

OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.

HIGH 70

OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0172 Published 2024-05-27 No fix listed CWE-89

TI-2025-40763 CVE-2025-66289

OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change

MEDIUM 45

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00295 Published 2025-11-29 Fixed in 5.8 CWE-613

TI-2019-09618 CVE-2019-12839 · GHSA-jfjp-j6rr-f5f8

In OrangeHRM 4.3.1 and before, there is an input validation error within…

MEDIUM 45

In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated attackers to achieve arbitrary command execution.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04369 Published 2019-06-15 No fix listed CWE-78

TI-2007-01160 CVE-2007-1193 · GHSA-h4mg-pjh9-pc8p

Multiple unspecified vulnerabilities in the Login page in OrangeHRM before 20070212 have…

MEDIUM 43

Multiple unspecified vulnerabilities in the Login page in OrangeHRM before 20070212 have unknown impact and attack vectors.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.01337 Published 2007-03-02 No fix listed

TI-2025-40726 CVE-2025-66224

OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection

MEDIUM 42

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00602 Published 2025-11-29 Fixed in 5.8 CWE-94

TI-2020-17674 CVE-2020-29437 · GHSA-hg4w-g985-vv3m

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated…

MEDIUM 41

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.02848 Published 2021-01-05 No fix listed CWE-89

TI-2025-40727 CVE-2025-66225

OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow

LOW 39

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00188 Published 2025-11-29 Fixed in 5.8 CWE-20

TI-2010-04521 CVE-2010-4798 · GHSA-p58w-8546-2xhw

Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote…

LOW 35

Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the uri parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02331 Published 2011-04-27 No fix listed CWE-22

TI-2025-28576 CVE-2025-44040 · GHSA-vj38-xwp2-x5gc

An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php…

LOW 34

An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00463 Published 2025-05-21 No fix listed CWE-269

TI-2011-04532 CVE-2011-5259 · GHSA-9w3r-phm7-v8q5

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before…

LOW 33

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0123 Published 2013-02-12 No fix listed CWE-89

TI-2012-01316 CVE-2012-1506 · GHSA-h44f-xp3m-jxrx

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php…

LOW 31

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugin…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01304 Published 2014-09-17 No fix listed CWE-89

TI-2012-04541 CVE-2012-5367 · GHSA-m5vh-g3xf-grvj

Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated…

LOW 30

Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to (1) viewCustomers, (2) viewPayGrades, or (3) viewS…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.0132 Published 2012-12-03 No fix listed CWE-89

TI-2026-28336 CVE-2026-39348

Missing authorization in orangehrm

LOW 29

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00168 Published 2026-04-07 Fixed in 5.8.1 CWE-862

TI-2025-40765 CVE-2025-66291

OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments

LOW 29

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00214 Published 2025-11-29 Fixed in 5.8 CWE-200

TI-2025-40764 CVE-2025-66290

OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachments

LOW 29

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00206 Published 2025-11-29 Fixed in 5.8 CWE-200

TI-2022-11567 CVE-2022-28985 · GHSA-qjfp-xc6m-h4xx

A stored cross-site scripting (XSS) vulnerability in the addNewPost component of…

LOW 29

A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00517 Published 2022-05-20 No fix listed CWE-79

TI-2021-09538 CVE-2021-28399 · GHSA-j4rv-w4j7-w5fq

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email…

LOW 26

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00953 Published 2021-04-26 No fix listed

TI-2022-10262 CVE-2022-27110 · GHSA-cq9j-5j4q-jxhw

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.

LOW 25

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00463 Published 2022-04-06 No fix listed CWE-601

TI-2022-10261 CVE-2022-27109 · GHSA-cm9m-cxm8-jf6x

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.

LOW 25

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00463 Published 2022-04-06 No fix listed CWE-601

TI-2022-10259 CVE-2022-27107 · GHSA-rhjq-68v2-wq5j

OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under…

LOW 25

OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" parameter

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00487 Published 2022-04-06 No fix listed CWE-79

TI-2013-01189 CVE-2013-1353 · GHSA-m9wq-xvhm-rxg4

Orange HRM 2.7.1 allows XSS via the vacancy name.

LOW 25

Orange HRM 2.7.1 allows XSS via the vacancy name.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0059 Published 2020-02-10 No fix listed CWE-79

TI-2012-01317 CVE-2012-1507 · GHSA-99cq-pmj3-v2hx

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote…

LOW 25

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sor…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02355 Published 2014-09-17 No fix listed CWE-79

TI-2011-03323 CVE-2011-3766 · GHSA-7jpc-9q98-9w88

OrangeHRM 2.6.0.2 allows remote attackers to obtain sensitive information via a direct…

LOW 25

OrangeHRM 2.6.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/orange/menu/Menu.php and c…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01242 Published 2011-09-24 No fix listed CWE-200

TI-2007-05670 CVE-2007-5931 · GHSA-8cvf-9rjv-7x86

The reDirect function in lib/controllers/RepViewController.php in OrangeHRM before 2.2.2…

LOW 25

The reDirect function in lib/controllers/RepViewController.php in OrangeHRM before 2.2.2 does not verify the privileges of a user, which allows remote attackers to obtain access to data via unspecified vectors.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01256 Published 2007-11-10 No fix listed CWE-264

TI-2011-04531 CVE-2011-5258 · GHSA-c53q-wg6w-6jm7

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the (1) uniqcode or (2) isAdmin parameter to index.php; or the (3) PATH_I…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02092 Published 2013-02-12 No fix listed CWE-79

Open these records in search →