CVE-2020-29437

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsFormprofileUserId parameter to the buzz/loadMoreProfile endpoint...

CVE-2020-29437

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsFormprofileUserId parameter to the buzz/loadMoreProfile endpoint...

PT-2021-11664

Name of the Vulnerable Software and Affected Versions: OrangeHRM versions through 4.6 Description: The issue allows remote authenticated attackers to execute arbitrary SQL commands via the loadMorePostsFormprofileUserId parameter to the "buzz/loadMoreProfile" endpoint. This is due to a SQL...