Vulnerabilities

TI-2020-19280 CVE-2020-37145 · GHSA-xp6x-54qx-mg3m

HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)

LOW 22

HRSALE 1.1.8 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized administrative users through the employee registration form.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00174 Published 2026-02-05 No fix listed CWE-352

TI-2020-17546 CVE-2020-29053 · GHSA-m74v-w86v-39q5

HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.

LOW 28

HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00696 Published 2020-11-24 No fix listed CWE-79

TI-2020-17027 CVE-2020-27993 · GHSA-xhpr-rcx8-q343

Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files.

LOW 29

Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02536 Published 2020-10-29 No fix listed CWE-22

Vulnerabilities

Filters

HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)

HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.

Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files.