CVE-2025-22953

Epicor HCM 2021 version 1.9 is vulnerable to unauthenticated SQL injection in the filter parameter of the JsonFetcher.svc endpoint. The underlying cause is improper handling of the filter parameter, allowing arbitrary SQL commands to be executed on the backend database; if xp_cmdshell or similar ...