CVE-2025-10197

🗓️ 10 Sep 2025 00:32:06Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 11 Views🌐 WEB

CVE-2025-10197 affects HJSoft HCM; SQL injection via ID in downlawbase enables remote exploitation.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2025-10197	10 Sep 202502:01	–	circl
CNNVD	HJSoft HCM Human Resources Management System 注入漏洞	10 Sep 202500:00	–	cnnvd
Cvelist	CVE-2025-10197 HJSoft HCM Human Resources Management System downlawbase sql injection	10 Sep 202500:32	–	cvelist
EUVD	EUVD-2025-27516	3 Oct 202520:07	–	euvd
NVD	CVE-2025-10197	10 Sep 202501:15	–	nvd
Positive Technologies	PT-2025-37002	10 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-10197	12 Sep 202501:24	–	redhatcve
Vulnrichment	CVE-2025-10197 HJSoft HCM Human Resources Management System downlawbase sql injection	10 Sep 202500:32	–	vulnrichment

Vulners

Node

hjsoft hcm_human_resources_management_systemMatch20250822

[
  {
    "vendor": "HJSoft",
    "product": "HCM Human Resources Management System",
    "versions": [
      {
        "version": "20250822",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/eeeeeekkkkkkkk/POC/blob/main/%E5%AE%8F%E6%99%AFHCM%20%E4%BA%BA%E5%8A%9B%E8%B5%84%E6%BA%90%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9Fdownlawbase%E6%8E%A5%E5%8F%A3%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
ID	query param	/templates/attestation/../../selfservice/lawresource/downlawbase	SQL injection via manipulated ID parameter in the downlawbase endpoint.	CWE-74, CWE-89

29 Apr 2026 01:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 45.3

CVSS 3.16.3

CVSS 26.5

CVSS 36.3

EPSS0.00037

SSVC