66 matches found
CVE-2026-91770 IceHRM before 36.0.0 Broken Access Control via Employee ID
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoint...
CVE-2026-91770 IceHRM before 36.0.0 Broken Access Control via Employee ID
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoint...
CVE-2026-91770
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints (skill, education, certification, language, leave, attendance, and status), allowing any authenticated employee to substitute arbitrary employee IDs and read colleagues' HR records. The vulnerability is...
CVE-2026-91770 IceHRM before 36.0.0 Broken Access Control via Employee ID
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoint...
CVE-2026-5790
Stored Cross-Site Scripting XSS in Stel Order v3.25.1 and earlier, located at the ā/app/FrontControllerā endpoint via the ālegalNameā and āemployeeIDā parameters. The lack of proper input sanitization allows an attacker to inject malicious code that is persistently stored in the database. When...
EUVD-2026-34024
A vulnerability has been found in SourceCodester Human Resource Management 1.0. Affected by this vulnerability is an unknown functionality of the file /detailview.php of the component Employee View Page. Such manipulation of the argument employeeid leads to improper control of resource identifier...
CVE-2026-10286 CodeAstro Payroll System home_employee.php sql injection
A vulnerability was found in CodeAstro Payroll System 1.0. This affects an unknown part of the file /homeemployee.php. The manipulation of the argument empid results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used...
CVE-2026-10286 CodeAstro Payroll System home_employee.php sql injection
A vulnerability was found in CodeAstro Payroll System 1.0. This affects an unknown part of the file /homeemployee.php. The manipulation of the argument empid results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used...
CVE-2026-5798
Unsafe object reference IDOR in Stel Order v3.25.1 and earlier versions, specifically in the ā/app/FrontControllerā endpoint, through manipulation of the āemployeeIDā parameter. An authenticated attacker could exploit this vulnerability to access information about any employee first names, last...
CVE-2026-5790
Stored Cross-Site Scripting XSS in Stel Order v3.25.1 and earlier, located at the ā/app/FrontControllerā endpoint via the ālegalNameā and āemployeeIDā parameters. The lack of proper input sanitization allows an attacker to inject malicious code that is persistently stored in the database. When...
CVE-2026-5798
CVE-2026-5798 affects Stel Order v3.25.1 and earlier. The vulnerability is an unsafe object reference (IDOR) in the /app/FrontController endpoint, exploitable by manipulating the employeeID parameter in requests. An authenticated attacker could access information about any employee (e.g., first n...
EUVD-2026-23264
SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/viewaccount.php?empid=...
CVE-2026-37346
SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/viewaccount.php?empid=...
CVE-2026-37346
SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/viewaccount.php?empid=...
CVE-2026-37346
SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/viewaccount.php?empid=...
CVE-2026-5681
A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file /borrowedequip.php of the component Parameter Handler. This manipulation of the argument empid causes sql injection. The attack is possible to be carried out remotely. The explo...
PT-2026-30717
A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file /borrowedequip.php of the component Parameter Handler. This manipulation of the argument emp id causes sql injection. The attack is possible to be carried out remotely. The...
CVE-2026-33730
Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference IDOR vulnerability allows an authenticated low-privileged user to access the password change functionality of...
CVE-2026-33730
Open Source Point of Sale (opensourcepos) is a PHP web app using CodeIgniter. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) allows an authenticated low-privilege user to access the password change functionality of other users (including administrators) by manipulating the emp...
CVE-2026-33730
Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference IDOR vulnerability allows an authenticated low-privileged user to access the password change functionality of...