CVE-2025-44040

An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be made via PHP loose-equality comparisons if a specific MD5 value is present in the credential store. NOTE: this is disputed by the Supplier...

CVE-2025-44040

OrangeHRM v.5.7 is vulnerable to a privilege escalation issue within the UserService.php file, specifically involving the checkForOldHash function. The vulnerability arises because authentication decisions might be influenced by PHP loose-equality comparisons if a specific MD5 value exists in the...