CVE-2024-34221

基于 PHP 和 MySQL 的人力资源管理系统项目免费源代码 提交者：Kha Do 漏洞类型 权限设置不当 描述 SourceCodester 人力资源管理系统 1.0 中的 /hrm/controller/ccity.php?positionedit= 存在权限设置不当漏洞，攻击者可访问普通用户无权访问的功能。 受影响组件 路径 URL：/hrm/controller/ccity.php?positionedit= 参数：position.php 影响 攻击者可使用普通账户添加新职位，而普通用户本无权执行此操作。 POC...

CVE-2024-35469

CVE-2024-35469 提出者: Kha Do 人事管理システム 1.0 脆弱性 SQLインジェクション 説明 SourceCodester 人事管理システム 1.0 の /hrm/user/ における SQLインジェクションの脆弱性により、攻撃者はpasswordパラメータを介して任意のSQLコマンドを実行できます。 影響を受けるコンポーネント /hrm/user/ 影響 攻撃者はペイロード 'or'1'='1 を使用して、認証情報なしで管理者アカウントでログインできます。 POC 匿名でログイン 脆弱性を含むソースコード 動画...

CVE-2024-34223

PHPとMySQLを使用した人事管理システムプロジェクト フリーソースコード 投稿者: Kha Do 脆弱性 安全でない権限 説明 SourceCodester Human Resource Management System 1.0の/hrm/leaverequest.phpにおける安全でない権限の脆弱性により、攻撃者が休暇申請を承認または拒否できる可能性があります。 影響を受けるコンポーネント パスURL: /hrm/leaverequest.php パラメータ: ?msg= 、?id= 影響 通常ユーザーが休暇申請を自己承認または拒否できるため、許可されていない操作が可能です。 i...

CVE-2024-34222

Human Resource Management System 1.0 提出者: Kha Do 脆弱性 SQLインジェクション 説明 SourceCodester Human Resource Management System 1.0 の /hrm/country.php における SQL インジェクションの脆弱性により、攻撃者は searccountry パラメータを介して任意の SQL コマンドを実行できる可能性があります。 影響を受けるコンポーネント パス URL: /hrm/country.php パラメータ: & searccountry=inject here 影響...

CVE-2022-46104---POC

CVE-2022-46104 https://www.sourcecodester.com/ 在人力资源管理系统项目的loginn.php页面中发现了XSS漏洞： 执行payload： http://localhost/hrm/loginn.php?msg=%3Cscript%3Ealert%27XSS%27%3C/script%3E...

CVE-2019-15813

CVE-2019-15813 此容器用于解释并演示 CVE-2019-15813（Sentrifugo 的工作原理） Sentrifugo V3.2 Sentrifugo 是一个人力资源管理系统 如何安装 docker-compose up 默认测试凭据 ----超级管理员---- 用户名：empp0001 密码：5faa7bdf3d7af ---员工---- 用户名：EMPP123 密码：bygedupub --反向 PHP Shell-- 解压 resume.zip（因 Windows Defender 可能删除该文件而打包） 编辑 IP 地址和端口...

CVE-2026-70560

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560

CVE-2026-70560 affects Ultimate POS (Stock Management & Point of Sale). A stored XSS vulnerability allows low-privileged authenticated users to inject arbitrary HTML/script by submitting a malicious payload in the user first-name field during account creation. When such a user with a low-privileg...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

EUVD-2026-57170

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

PT-2026-71057

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

EUVD-2026-46977

Vulnerability in the JD Edwards EnterpriseOne HCM Foundation product of Oracle JD Edwards component: Time Accounting and HRM Base. The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards...

CVE-2026-9237

The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-42566

The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-9237 Employee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action

The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-9237

Summary: CVE-2026-9237 affects the WordPress plugin “Crew HRM” (Employee, Leave and Recruitment Management System). All versions up to 1.2.2 are vulnerable to an authorization bypass due to improper access verification. Authenticated users with subscriber-level access or higher can delete, archiv...

CVE-2026-13525

A vulnerability was detected in CodeAstro Human Resource Management System 1.0. This issue affects the function emselectByCode of the file application/models/Employeemodel.php of the component UpdateEarnLeave Endpoint. The manipulation of the argument emid results in sql injection. The attack can...

CVE-2026-27351

Missing Authorization vulnerability in Sekander Badsha Crew HRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Crew HRM: from n/a through 1.2.2...

CVE-2026-27351 WordPress Crew HRM plugin <= 1.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sekander Badsha Crew HRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Crew HRM: from n/a through 1.2.2...