Vulnerabilities

TI-2026-28337 CVE-2026-39349

OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure

LOW 10

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00114 Published 2026-04-07 Fixed in 5.8.1 CWE-326

TI-2026-28336 CVE-2026-39348

Missing authorization in orangehrm

LOW 29

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00168 Published 2026-04-07 Fixed in 5.8.1 CWE-862

TI-2026-28335 CVE-2026-39347

OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion

LOW 22

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00175 Published 2026-04-07 Fixed in 5.8.1 CWE-285

TI-2026-28334 CVE-2026-39346

OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding

LOW 23

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00156 Published 2026-04-07 Fixed in 5.8.1 CWE-284

TI-2026-28333 CVE-2026-39345

OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader

LOW 21

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0MEDIUM 4.6 Network High privileges No interaction EPSS 0.00329 Published 2026-04-07 Fixed in 5.8.1 CWE-22

TI-2025-40765 CVE-2025-66291

OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments

LOW 29

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00214 Published 2025-11-29 Fixed in 5.8 CWE-200

TI-2025-40764 CVE-2025-66290

OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachments

LOW 29

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00206 Published 2025-11-29 Fixed in 5.8 CWE-200

TI-2025-40763 CVE-2025-66289

OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change

MEDIUM 45

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00295 Published 2025-11-29 Fixed in 5.8 CWE-613

TI-2025-40727 CVE-2025-66225

OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow

LOW 39

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00188 Published 2025-11-29 Fixed in 5.8 CWE-20

TI-2025-40726 CVE-2025-66224

OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection

MEDIUM 42

OrangeHRM is a comprehensive human resource management (HRM) system.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00602 Published 2025-11-29 Fixed in 5.8 CWE-94

TI-2025-28576 CVE-2025-44040 · GHSA-vj38-xwp2-x5gc

An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php…

LOW 34

An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00463 Published 2025-05-21 No fix listed CWE-269

TI-2024-24213 CVE-2024-36428

OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.

HIGH 70

OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0172 Published 2024-05-27 No fix listed CWE-89

TI-2022-11567 CVE-2022-28985 · GHSA-qjfp-xc6m-h4xx

A stored cross-site scripting (XSS) vulnerability in the addNewPost component of…

LOW 29

A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00517 Published 2022-05-20 No fix listed CWE-79

TI-2022-10262 CVE-2022-27110 · GHSA-cq9j-5j4q-jxhw

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.

LOW 25

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00463 Published 2022-04-06 No fix listed CWE-601

TI-2022-10261 CVE-2022-27109 · GHSA-cm9m-cxm8-jf6x

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.

LOW 25

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00463 Published 2022-04-06 No fix listed CWE-601

TI-2022-10260 CVE-2022-27108 · GHSA-729r-q9xr-m8j5

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point…

LOW 21

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00588 Published 2022-04-06 No fix listed CWE-639

TI-2022-10259 CVE-2022-27107 · GHSA-rhjq-68v2-wq5j

OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under…

LOW 25

OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" parameter

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00487 Published 2022-04-06 No fix listed CWE-79

TI-2021-09538 CVE-2021-28399 · GHSA-j4rv-w4j7-w5fq

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email…

LOW 26

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00953 Published 2021-04-26 No fix listed

TI-2020-17674 CVE-2020-29437 · GHSA-hg4w-g985-vv3m

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated…

MEDIUM 41

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.02848 Published 2021-01-05 No fix listed CWE-89

TI-2013-01189 CVE-2013-1353 · GHSA-m9wq-xvhm-rxg4

Orange HRM 2.7.1 allows XSS via the vacancy name.

LOW 25

Orange HRM 2.7.1 allows XSS via the vacancy name.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0059 Published 2020-02-10 No fix listed CWE-79

TI-2019-09618 CVE-2019-12839 · GHSA-jfjp-j6rr-f5f8

In OrangeHRM 4.3.1 and before, there is an input validation error within…

MEDIUM 45

In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated attackers to achieve arbitrary command execution.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04369 Published 2019-06-15 No fix listed CWE-78

TI-2014-08285 CVE-2014-100021 · GHSA-hpm6-pjvf-rhgh

Cross-site scripting (XSS) vulnerability in symfony/web/index.php/pim/viewEmployeeList in…

LOW 23

Cross-site scripting (XSS) vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the empsearch[employee_name][empId] para…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0122 Published 2015-01-13 No fix listed CWE-79

TI-2012-01317 CVE-2012-1507 · GHSA-99cq-pmj3-v2hx

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote…

LOW 25

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sor…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02355 Published 2014-09-17 No fix listed CWE-79

TI-2012-01316 CVE-2012-1506 · GHSA-h44f-xp3m-jxrx

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php…

LOW 31

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugin…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01304 Published 2014-09-17 No fix listed CWE-89

TI-2011-04532 CVE-2011-5259 · GHSA-9w3r-phm7-v8q5

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before…

LOW 33

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0123 Published 2013-02-12 No fix listed CWE-89

Vulnerabilities

Filters