CVE-2024-34221

基于 PHP 和 MySQL 的人力资源管理系统项目免费源代码 提交者：Kha Do 漏洞类型 权限设置不当 描述 SourceCodester 人力资源管理系统 1.0 中的 /hrm/controller/ccity.php?positionedit= 存在权限设置不当漏洞，攻击者可访问普通用户无权访问的功能。 受影响组件 路径 URL：/hrm/controller/ccity.php?positionedit= 参数：position.php 影响 攻击者可使用普通账户添加新职位，而普通用户本无权执行此操作。 POC...

CVE-2025-40682

The CVE-2025-40682 entry concerns Human Resource Management System (version 1.0). The vulnerability is a SQL injection in the /controller/ccity.php endpoint, exploitable via the city and state parameters, enabling an attacker to retrieve, create, update, and delete databases. Root cause described...

CVE-2025-40682: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint...