OrangeHRM 2.7 RC - '/plugins/ajaxCalls/haltResumeHsp.php?hspSummaryId' SQL Injection

source: https://www.securityfocus.com/bid/53433/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify...

OrangeHRM 2.7 RC - index.php?URI Cross-Site Scripting

OrangeHRM 2.7 RC - index.php?URI Cross-Site Scripting source: https://www.securityfocus.com/bid/53433/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication...

OrangeHRM 2.7 RC - '/plugins/ajaxCalls/haltResumeHsp.php?newHspStatus' Cross-Site Scripting

source: https://www.securityfocus.com/bid/53433/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify...

OrangeHRM 2.7 RC - 'index.php?URI' Cross-Site Scripting

source: https://www.securityfocus.com/bid/53433/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify...

Multiple vulnerabilities in OrangeHRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OrangeHRM, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 SQL Injection in OrangeHRM: CVE-2012-1506 1.1 Input passed via the "hspSummaryId" GET parameter to...

Multiple vulnerabilities in OrangeHRM

Vulnerability ID: HTB23057 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinorangehrm.html Product: OrangeHRM Vendor: OrangeHRM Inc. http://www.orangehrm.com Vulnerable Version: 2.6.11 and probably prior Tested Version: 2.6.11 Vendor Notification: 09 November 2011 Vulnerabilit...

OrangeHRM 2.6.11 Cross Site Scripting / SQL Injection

Vulnerability ID: HTB23057 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinorangehrm.html Product: OrangeHRM Vendor: OrangeHRM Inc. http://www.orangehrm.com Vulnerable Version: 2.6.11 and probably prior Tested Version: 2.6.11 Vendor Notification: 09 November 2011 Vulnerabilit...

Multiple vulnerabilities in OrangeHRM

No description provided by source. Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinorangehrm.html Product: OrangeHRM Vendor: OrangeHRM Inc. http://www.orangehrm.com Vulnerable Version: 2.6.11 and probably prior Tested Version: 2.6.11 Vendor Notification: 09 November 2011...

OrangeHRM 2.6.11 - index.php Multiple Cross-Site Scripting Vulnerabilities

OrangeHRM 2.6.11 - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/50857/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based...

OrangeHRM 2.6.11 - '/lib/controllers/CentralController.php?id' SQL Injection

source: https://www.securityfocus.com/bid/50857/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify...

OrangeHRM 2.6.11 - 'lib/controllers/CentralController.php' URI Cross-Site Scripting

source: https://www.securityfocus.com/bid/50857/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify...

OrangeHRM 2.6.11 - libcontrollersCentralController.php URI Cross-Site Scripting

OrangeHRM 2.6.11 - libcontrollersCentralController.php URI Cross-Site Scripting source: https://www.securityfocus.com/bid/50857/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal...

OrangeHRM 2.6.11 - libcontrollersCentralController.php?id SQL Injection

OrangeHRM 2.6.11 - libcontrollersCentralController.php?id SQL Injection source: https://www.securityfocus.com/bid/50857/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based...

OrangeHRM 2.6.11 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/50857/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify...

Multiple Vulnerabilities in OrangeHRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OrangeHRM, which can be exploited to perform Cross-Site Scripting XSS and SQL Injection attacks. 1 Cross-Site Scripting XSS vulnerabilities in OrangeHRM 1.1 Input passed via the "uniqcode" GET parameter to...

CVE-2011-3766

OrangeHRM 2.6.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/orange/menu/Menu.php and certain other files...

Information disclosure

OrangeHRM 2.6.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/orange/menu/Menu.php and certain other files...

CVE-2011-3766

OrangeHRM 2.6.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/orange/menu/Menu.php and certain other files...

CVE-2011-3766

OrangeHRM 2.6.0.2 is affected by an information-disclosure vulnerability in which a direct request to a .php file reveals the installation path in an error message (demonstrated by themes/orange/menu/Menu.php and other files). This is a server-side disclosure that could aid attackers in reconnais...

OrangeHRM 'PluginController.php' Local File Inclusion Vulnerability

This host is running with OrangeHRM and is prone to local file inclusion vulnerability. OpenVAS Vulnerability Test $Id: secpodorangehrmlfivuln.nasl 7577 2017-10-26 10:41:56Z cfischer $ OrangeHRM 'PluginController.php' Local File Inclusion Vulnerability Authors: Madhuri D Copyright: Copyright c 20...