10 matches found
CVE-2026-33730: Authorization Bypass Through User-Controlled Key
Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference IDOR vulnerability allows an authenticated low-privileged user to access the password change functionality of...
CVE-2026-24035: Improper Access Control
Horilla is a free and open source Human Resource Management System HRMS. An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prior to version 1.5.0, allowing any authenticated employee to upload documents on behalf of another employee without prope...
CVE-2025-14568: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This impacts an unknown function of the file model/User.php. The manipulation of the argument employeeid/id/admin leads to sql injection. The attack can be initiated...
Human Resource Integrated System login_attendance2.php File SQL Injection Vulnerability
Human Resource Integrated System is a human resource management system. Human Resource Integrated System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter employeeid/date in the file loginattendance2.php. A...
CVE-2025-9743 code-projects Human Resource Integrated System login_attendance2.php sql injection
A security flaw has been discovered in code-projects Human Resource Integrated System 1.0. Impacted is an unknown function of the file loginattendance2.php. Performing manipulation of the argument employeeid/date results in sql injection. The attack can be initiated remotely. The exploit has been...
CVE-2025-9743: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in code-projects Human Resource Integrated System 1.0. Impacted is an unknown function of the file loginattendance2.php. Performing manipulation of the argument employeeid/date results in sql injection. The attack can be initiated remotely. The exploit has been...
CVE-2025-7131: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Campcodes Payroll Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=saveemployeeattendance. The manipulation of the argument employeeid leads to sql injection. The attack ca...
WordPress WPHRM plugin <= 1.0 - Authenticated SQL Injection
WordPress WPHRM plugin Authenticated SQL Injection allows an attacker to inject SQL commands via the employeeid $GET param. Solution Update the plugin...
CVE-2017-14848: Improper Neutralization of Special Elements used in an SQL Command
WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employeeid parameter...
