CVE-2025-59525 Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG and via allowed , which can be chained to execute JavaScript whenever users view impacted content e.g., announcements. This can...

CVE-2025-59524 Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, the file upload flow performs validation only in the browser and does not enforce server-side checks. An attacker can bypass the client-side validation for example, with an intercepting proxy or by...

CVE-2025-48867 Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules

Horilla is a free and open source Human Resource Management System HRMS. A stored cross-site scripting XSS vulnerability in Horilla HRM 1.3.0 allows authenticated admin or privileged users to inject malicious JavaScript payloads into multiple fields in the Project and Task modules. These payloads...

CVE-2025-48869 Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control

Horilla is a free and open source Human Resource Management System HRMS. Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing attackers to retrieve sensitive...

CVE-2025-10197

A vulnerability was found in HJSoft HCM Human Resources Management System up to 20250822. Affected by this vulnerability is an unknown functionality of the file /templates/attestation/../../selfservice/lawresource/downlawbase. Performing manipulation of the argument ID results in sql injection...

CVE-2025-40683

Reflected Cross-Site Scripting XSS in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searccity' parameter in /city.php...

CVE-2013-3785

Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Products 9.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Career's Home...

CVE-2011-0857

Unspecified vulnerability in Oracle PeopleSoft Enterprise HRMS 9.0 Bundle 15 and 9.1 Bundle 5 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Pension Administration...

CVE-2025-47789

Horilla is a free and open source Human Resource Management System HRMS. In versions up to and including 1.3, an attacker can craft a Horilla URL that refers to an external domain. Upon clicking and logging in, the user is redirected to an external domain. This allows the redirection to any...

CVE-2025-47789

Horilla is a free and open source Human Resource Management System HRMS. In versions up to and including 1.3, an attacker can craft a Horilla URL that refers to an external domain. Upon clicking and logging in, the user is redirected to an external domain. This allows the redirection to any...

CVE-2025-1815

A vulnerability, which was classified as critical, was found in pbrong hrms up to 1.0.1. This affects the function HrmsDB of the file \resource\resource.go. The manipulation of the argument usercookie leads to improper authorization. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-1815

Affected software: pbrong hrms up to 1.0.1. The vulnerability occurs in HrmsDB (resource.go) due to manipulation of the user_cookie argument, causing improper authorization. This enables a remote attack, and the exploit has been disclosed publicly. No patch/version remediation details are provide...

CVE-2025-1815 pbrong hrms resource.go HrmsDB improper authorization

A vulnerability, which was classified as critical, was found in pbrong hrms up to 1.0.1. This affects the function HrmsDB of the file \resource\resource.go. The manipulation of the argument usercookie leads to improper authorization. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-1815 pbrong hrms resource.go HrmsDB improper authorization

A vulnerability, which was classified as critical, was found in pbrong hrms up to 1.0.1. This affects the function HrmsDB of the file \resource\resource.go. The manipulation of the argument usercookie leads to improper authorization. It is possible to initiate the attack remotely. The exploit has...

Human Resource Management System security breach

Human Resource Management System is a human resource management system by maverickosama Personal Developer. A security vulnerability exists in SourceCodester Human Resource Management System version 1.0, which originates from a SQL injection vulnerability that allows an attacker to execute...

Human Resource Management System 1.0 SQL Injection

Exploit Title: Human Resource Management System - SQL Injection Date: 13-01-2024 Exploit Author: Srikar Exp1o1t9r Vendor Homepage: https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.html Software Link:...

SQL Injection Vulnerability in Macroview HCM Human Resource Management System

Macroview HCM Human Resource Management System is a human resource management software. A SQL injection vulnerability exists in Macroview HCM Human Resource Management System, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2022-45218

CVE-2022-45218 affects the Home Resource Management System (HRMS) v1.0.0. The vulnerability is a Cross‑Site Scripting (XSS) flaw triggered by a crafted payload injected into an authentication error message. The issue is documented across multiple feeds (NVD/Red Hat/ CNNVD, etc.) with the same des...

CVE-2022-3497

A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been classified as problematic. Affected is an unknown function of the component Master List. The manipulation of the argument city/state/country/position leads to cross site scripting. It is possible to laun...

Improper access control

A vulnerability was found in SourceCodester Human Resource Management System 1.0 and classified as critical. This issue affects some unknown processing of the file employeeadd.php of the component Admin Panel. The manipulation leads to improper access controls. The attack may be initiated remotel...