CVE-2018-10257

A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution...

CVE-2018-10260

A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user...

CVE-2018-10256

A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to directly modify the SQL query...

CVE-2018-10256

A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to directly modify the SQL query...

Cross site scripting

An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user...

Input validation

A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution...

Remote file inclusion

A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user...

CVE-2018-10257

A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution...

CVE-2018-10256

A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to directly modify the SQL query...

CVE-2018-10260

A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user...

CVE-2018-10260

HRSALE The Ultimate HRM v1.0.2 is affected by a Local File Inclusion vulnerability exploitable by a low-privileged user. The PoC demonstrates file reads via the admin/download endpoint (e.g., filename=../../../../../../../../etc/passwd). Multiple connected sources (NVD CVE-2018-10260, Exploit-DB,...

CVE-2018-10256

HRSALE The Ultimate HRM v1.0.2 contains a SQL injection vulnerability exploitable via the award_id parameter in the admin/read_awards endpoint. A low-privilege user can influence the SQL query, with PoC payloads demonstrating boolean-based blind injection. Several public references (Exploit-DB, P...

CVE-2018-10259

An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user...

CVE-2018-10257

CVE-2018-10257 describes a CSV Injection in HRSALE The Ultimate HRM v1.0.2. A low-privilege user can inject a command into CSV exports (e.g., in the First Name field) that becomes part of the downloaded file, potentially leading to code execution. The PoC shows adding =cmd|'/C calc'!A1 in a user’...

PT-2018-9791

Name of the Vulnerable Software and Affected Versions: HRSALE The Ultimate HRM version 1.0.2 Description: A CSV Injection issue was discovered that allows a user with low-level privileges to inject a command into the exported CSV file, potentially leading to code execution. Recommendations: For...

PT-2018-9790

Name of the Vulnerable Software and Affected Versions: HRSALE The Ultimate HRM version 1.0.2 Description: A SQL Injection issue was discovered that allows a user with low-level privileges to directly modify the SQL query. Recommendations: For HRSALE The Ultimate HRM version 1.0.2, at the moment,...

CVE-2018-10256: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to directly modify the SQL query...

PT-2018-9794

Name of the Vulnerable Software and Affected Versions: HRSALE The Ultimate HRM version 1.0.2 Description: A Local File Inclusion issue was discovered, which can be exploited by a low-privileged user. Recommendations: For HRSALE The Ultimate HRM version 1.0.2, at the moment, there is no informatio...

CVE-2018-10257: Improper Neutralization of Formula Elements in a CSV File

A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution...

PT-2018-9793

Name of the Vulnerable Software and Affected Versions: HRSALE The Ultimate HRM version 1.0.2 Description: An Authenticated Stored XSS issue was found, which can be exploited by a low-privileged user. Recommendations: For HRSALE The Ultimate HRM version 1.0.2, at the moment, there is no informatio...