Leme Consultoria HCM galera.app 安全漏洞

Leme Consultoria HCM galera.app is a human resource management system from Leme Consultoria, a Brazilian company that provides a full employee lifecycle management solution. A security vulnerability exists in Leme Consultoria HCM galera.app version 4.58.0, which originates from SQL injection and...

PT-2025-20074 · Lemesconsultoria · Lemesconsultoria Hcm Galera.App

Name of the Vulnerable Software and Affected Versions: lemesconsultoria HCM galera.app version 4.58.0 Description: The issue allows an attacker to execute arbitrary code via multiple API endpoints, including "/ted/solicitacao treinamento/", "/rh/metas/perspectiva estrategica/edicao/",...

CVE-2025-29154

CVE-2025-29154 affects lemesconsultoria HCM galera.app v4.58.0. HTML injection in multiple endpoints (e.g., /ted/solicitacao_treinamento/, /rh/metas/perspectiva_estrategica/edicao/, /escolaridade/listagem/, /estados_civis/cadastro/, /colaborador/cadastro/adc/, etc.) can lead to arbitrary code exe...

The vulnerability of Websoft HCM’s automation software for HR processes stems from insufficient validation of input data, allowing attackers to execute the displayed HTML code.

The vulnerability of Websoft HCM’s automation software for HR processes is related to insufficient verification of entered data. Exploiting this vulnerability allows a malicious actor to execute arbitrary reflected HTML code remotely...

The vulnerability of Websoft HCM’s automation software for HR processes stems from insufficient validation of input data, allowing attackers to execute the displayed HTML code.

The vulnerability of Websoft HCM’s automation software for HR processes is related to insufficient verification of entered data. Exploiting this vulnerability allows a malicious actor to execute arbitrary HTML code by sending a specially crafted POST request...

The vulnerability of Websoft HCM’s automation software for HR processes stems from incorrect restrictions on the path to the restricted catalog. This allows attackers to disclose protected information.

The vulnerability of Websoft HCM’s automation software for HR processes is related to incorrect restrictions on the path to the restricted-access catalog. Exploiting this vulnerability allows a malicious actor to disclose protected information...

CVE-2025-22953

A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting...

CVE-2025-22953

A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting...

CVE-2025-22953

A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting...

CVE-2025-22953

A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting...

CVE-2025-22953

Epicor HCM 2021 version 1.9 is vulnerable to unauthenticated SQL injection in the filter parameter of the JsonFetcher.svc endpoint. The underlying cause is improper handling of the filter parameter, allowing arbitrary SQL commands to be executed on the backend database; if xp_cmdshell or similar ...

CVE-2025-22953

A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting...

PT-2025-13576 · Epicor · Epicor Hcm

Name of the Vulnerable Software and Affected Versions: Epicor HCM version 2021 1.9 Description: A SQL injection vulnerability exists in the Epicor HCM, specifically in the filter parameter of the "JsonFetcher.svc" endpoint. An attacker can exploit this vulnerability by injecting malicious SQL...

Exploit for SQL Injection in Epicor Human_Capital_Management

CVE-2025-22953 – Epicor HCM Unauthenticated Blind SQL Injecti...

CVE-2025-1388

Orca HCM from LEARNING DIGITAL has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and run web shells...

CVE-2025-1389

Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-1387

Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user...

CVE-2025-1389

Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-1389

Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-1389 Learning Digital Orca HCM - SQL Injection

Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents...