CVE-2022-27110

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint...

CVE-2022-27109

CVE-2022-27109 affects OrangeHRM 4.10. The issue is a Referer header injection that enables redirect vulnerabilities. The connected Red Hat/CNVD entries reiterate the same description. The documents do not provide details on affected subcomponents, exact exploit steps, scope, or a remediation pat...

CVE-2022-27109

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability...

CVE-2022-27109

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability...

CVE-2022-27108

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...

CVE-2022-27108

CVE-2022-27108 relates to OrangeHRM 4.10 and is due to an Insecure Direct Object Reference (IDOR) in the endpoint symfony/web/index.php/time/createTimesheet. The vulnerability allows any user to create a timesheet in another user’s account. Connected documents corroborate the same description acr...

CVE-2022-27108

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...

CVE-2022-27107

OrangeHRM 4.10 contains a Stored XSS vulnerability in the 3Share Video3 feature under OrangeBuzz, exploitable via the GET/POST parameter createVideo[linkAddress]. The CVE notes this can allow JavaScript execution in the context of an affected user. CVSS metrics report MEDIUM severity (3.1) wi...

CVE-2022-27107

OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideolinkAddress" parameter...

CVE-2022-27107

OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideolinkAddress" parameter...

Orangehrm 安全漏洞

Orangehrm is a human resource management system HRM from Orangehrm, a US-based company. The system supports personnel information management, leave management, attendance management and recruitment management. orangehrm version 4.10 has a security vulnerability that can be exploited by an attacke...

Orangehrm 输入验证错误漏洞

Orangehrm is a human resource management system HRM from Orangehrm USA. The system supports personnel information management, leave management, time and attendance management and recruitment management, etc. Orangehrm version 4.10 has a Referer header injection redirection vulnerability, no...

Orangehrm 跨站脚本漏洞

Orangehrm is a human resource management system HRM from Orangehrm, a US-based company. The system supports personnel information management, leave management, attendance management and recruitment management, etc. Orangehrm version 4.10 has a cross-site scripting vulnerability that can be...

Orangehrm 输入验证错误漏洞

Orangehrm is a human resource management system HRM from Orangehrm, Inc. The system supports personnel information management, leave management, attendance management and recruitment management, etc. Orangehrm version 4.10 has an input validation error vulnerability, which stems from vulnerabilit...

Orangehrm Information Disclosure Vulnerability

Orangehrm is a human resource management system HRM from Orangehrm, USA. The system supports personnel information management, leave management, attendance management and recruitment management. An information disclosure vulnerability exists in OrangeHRM version 4.7 that could allow an...

CVE-2021-28399

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function...

CVE-2021-28399

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function...

CVE-2021-28399

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function...

Default credentials

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function...

CVE-2021-28399

Summary: CVE-2021-28399 affects OrangeHRM 4.7. An unauthenticated attacker can use the Forgot Password function to enumerate valid usernames and associated email addresses. The vulnerability is classified as an information disclosure issue with network access and low attack complexity, as describ...