PT-2015-3628

Name of the Vulnerable Software and Affected Versions OrangeHRM versions prior to 3.1.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the empsearchemployee nameempId parameter in the /pim/viewEmployeeList endpoint. Recommendations...

CVE-2014-100021: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the empsearchemployeenameempId parameter...