EUVD-2011-5158

Malware in sbrugna...

CVE-2011-5259: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2011-5258: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the 1 uniqcode or 2 isAdmin parameter to index.php; or the 3 PATHINFO to lib/controllers/centralcontroller.php...