CVE-2025-22953

A Blind SQL Injection vulnerability exists in Epicor HCM version 2021 1.9 . The flaw resides in the filter parameter of the JsonFetcher.svc endpoint (accessible via POST method), where an attacker can inject malicious SQL payloads without authentication. This allows for the unauthorized execution...