350 matches found
ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting (XSS)
Exploit Title: ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting XSS Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description The file upload feature in ICE Hrm Version 29.0.0.OS allows remote...
ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF)
Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery CSRF Exploit Author: Piyush Patil & Rafal Lykowski Vendor Homepage: https://icehrm.com/ Version: 29.0.0.OS Tested on: Windows 10 and Kali Description ICE Hrm Version 29.0.0.OS is vulnerable to CSRF which allows...
Orangehrm Information Disclosure Vulnerability
Orangehrm is a human resource management system HRM from Orangehrm, USA. The system supports personnel information management, leave management, attendance management and recruitment management. An information disclosure vulnerability exists in OrangeHRM version 4.7 that could allow an...
CVE-2020-35753
The job posting recommendation form in Persis Human Resource Management Portal Versions 17.2.00 through 17.2.35 and 19.0.00 through 19.0.20, when the "Recommend job posting" function is enabled, allows XSS via the SENDER parameter...
CVE-2020-35753
The CVE-2020-35753 issue affects Persis Human Resource Management Portal: versions 17.2.00–17.2.35 and 19.0.00–19.0.20, where the job posting recommendation form allows XSS via the SENDER parameter when the “Recommend job posting” function is enabled. The vulnerability is described as an XSS in t...
ccsa.hrmdirect.com Cross Site Scripting vulnerability OBB-1289241
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-9271
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php...
CVE-2020-9270
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php...
CVE-2020-9270
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php...
CVE-2020-9271
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php...
Cross site request forgery (csrf)
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php...
CVE-2020-9270
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php...
CVE-2020-9271
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php...
CVE-2020-9270
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php...
CVE-2020-9270
CVE-2020-9270 affects Ice Hrm 26.2.0, where a Cross-Site Request Forgery (CSRF) vulnerability enables a password reset via the service.php endpoint. The available connected records confirm IceHrm 26.2.0 is the affected version and describe the flaw as CSRF leading to unintended password resets; n...
CVE-2020-9271
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php...
CVE-2020-9271
Ice Hrm 26.2.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that can lead to user creation via service.php. The issue is documented across multiple sources (NVD, Red Hat, CNVD, OSV, etc.) with consistent description: unauthenticated CSRF could cause a legitimate user action to...
CVE-2020-9271: Cross-Site Request Forgery (CSRF)
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php...
PT-2020-20564
Name of the Vulnerable Software and Affected Versions ICE Hrm version 26.2.0 Description The issue allows for CSRF, leading to unauthorized password reset through the "service.php" endpoint. Recommendations For ICE Hrm version 26.2.0, update to a version that includes a fix for this issue, as no...