CVE-2026-47094 SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

CVE-2026-47094

SIMAC MyPHR 1.1 , a human resources management platform, is affected by an insecure direct object reference (IDOR) vulnerability in the /api/employes/put/{id} endpoint. Due to missing server-side ownership validation, an authenticated attacker can issue a PUT request with an arbitrary employee id...

CVE-2026-47094 SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...