PT-2024-15871 · WordPress · Innovs Hr Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Innovs HR WordPress plugin versions 1.0.3.4 and earlier Description: The issue concerns a lack of CSRF checks in some places within the Innovs HR WordPress plugin, which could allow attackers to make logged-in users perform unwanted actions v...

CVE-2024-2478

A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the file /bishe/register of the component Background Management. The manipulation of the argument userName leads to sql injection. The attack may be launched...

CVE-2024-2478

A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the file /bishe/register of the component Background Management. The manipulation of the argument userName leads to sql injection. The attack may be launched...

CVE-2024-2478

BradWenqiang HR 2.0 contains a SQL injection in the Background Management component: the selectAll function in /bishe/register is vulnerable via the userName parameter. The issue is exploitable remotely and an exploit has been disclosed (VDB-256886). Public Red Hat and other feeds mirror the same...

CVE-2024-2478 BradWenqiang HR Background Management register selectAll sql injection

A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the file /bishe/register of the component Background Management. The manipulation of the argument userName leads to sql injection. The attack may be launched...

CVE-2024-2478 BradWenqiang HR Background Management register selectAll sql injection

A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the file /bishe/register of the component Background Management. The manipulation of the argument userName leads to sql injection. The attack may be launched...

BradWenqiang HR SQL Injection Vulnerability

HR is a human resources management system by Brad Wenqiang Personal Developer. A SQL injection vulnerability exists in BradWenqiang HR version 2.0, which stems from the fact that incorrect manipulation of the parameter userName can lead to sql injection...

Innovs HR <= 1.0.3.4 - Employee Creation via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees. input type="hidden" name="maritalstatus" value="Single"...

Innovs HR <= 1.0.3.4 - Employee Creation via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees. PoC...

PT-2024-20327 · Yonyou · Yonyou Space-Time Enterprise Information Integration Platform

Name of the Vulnerable Software and Affected Versions: Yonyou space-time enterprise information integration platform versions 9.0 and earlier Description: The issue allows an attacker to obtain sensitive information via the gwbhAIM parameter in the "saveMove.jsp" file located in the "hr position"...

hr-homes.co.jp Improper Access Control vulnerability OBB-3843610

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

radio1.hr Improper Access Control vulnerability OBB-3835556

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-0469

CVE-2024-0469 affects code-projects’ Human Resource Integrated System 1.0. The vulnerability exists in the file update_personal_info.php where manipulating the parameter sex enables a SQL injection. This is a remotely exploitable issue, with public disclosure of the exploit. Several connected sou...

PT-2024-15587 · Unknown · Code-Projects Human Resource Integrated System

Name of the Vulnerable Software and Affected Versions: code-projects Human Resource Integrated System version 1.0 Description: A critical issue has been found in the system, affecting an unknown part of the file /admin route/inc service credits.php. The manipulation of the id argument leads to SQ...

CVE-2024-21747

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting.This issue affects WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CR...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting.This issue affects WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CR...

CVE-2024-21747

CVE-2024-21747 affects the WordPress WP ERP Plugin

Sql injection

SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance aka odoo-biometric-attendance v. 13.0 through 16.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the db parameter in the controllers/controllers.py...

CVE-2023-48050

SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance aka odoo-biometric-attendance v. 13.0 through 16.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the db parameter in the controllers/controllers.py...

CVE-2023-48050

CVE-2023-48050 affects Cams Biometrics Zkteco, eSSL, and the odoo-biometric-attendance integration module (HR Attendance) versions 13.0–16.0.1. The vulnerability is a SQL injection in controllers/controllers.py accessed via the db parameter, enabling remote code execution and privilege gain. Root...