EUVD-2014-1052

Malware in sbrugna...

EUVD-2021-15079

Malware in sbrugna...

EUVD-2011-5157

Malware in sbrugna...

EUVD-2019-4419

Malware in sbrugna...

EUVD-2011-5158

Malware in sbrugna...

EUVD-2012-1524

Malware in sbrugna...

EUVD-2007-1190

Malware in sbrugna...

EUVD-2012-1525

Malware in sbrugna...

EUVD-2022-31647

Malicious code in bioql PyPI...

EUVD-2022-31648

Malicious code in bioql PyPI...

EUVD-2022-33416

Malicious code in bioql PyPI...

EUVD-2025-16059

Malicious code in bioql PyPI...

EUVD-2022-31649

Malicious code in bioql PyPI...

EUVD-2022-31646

Malicious code in bioql PyPI...

CVE-2025-44040

An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be made via PHP loose-equality comparisons if a specific MD5 value is present in the credential store. NOTE: this is disputed by the Supplier...

CVE-2022-27107

OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideolinkAddress" parameter...

CVE-2022-28985

A stored cross-site scripting XSS vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...

CVE-2022-27108

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...

CVE-2021-28399

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function...

CVE-2020-29437

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsFormprofileUserId parameter to the buzz/loadMoreProfile endpoint...