CVE-2020-29437

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsFormprofileUserId parameter to the buzz/loadMoreProfile endpoint...

Orangehrm SQL Injection Vulnerability

Orangehrm is a human resource management system HRM from Orangehrm, USA. The system supports personnel information management, leave management, attendance management and recruitment management. OrangeHRM versions prior to 4.6.0.1 suffer from a SQL injection vulnerability that stems from the...

PT-2021-11664

Name of the Vulnerable Software and Affected Versions: OrangeHRM versions through 4.6 Description: The issue allows remote authenticated attackers to execute arbitrary SQL commands via the loadMorePostsFormprofileUserId parameter to the "buzz/loadMoreProfile" endpoint. This is due to a SQL...

CVE-2020-29437: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsFormprofileUserId parameter to the buzz/loadMoreProfile endpoint...