CVE-2020-29437

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsFormprofileUserId parameter to the buzz/loadMoreProfile endpoint...

CVE-2020-29437: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsFormprofileUserId parameter to the buzz/loadMoreProfile endpoint...

PT-2021-11664

Name of the Vulnerable Software and Affected Versions: OrangeHRM versions through 4.6 Description: The issue allows remote authenticated attackers to execute arbitrary SQL commands via the loadMorePostsFormprofileUserId parameter to the "buzz/loadMoreProfile" endpoint. This is due to a SQL...