Orangehrm@2.6.0.1 Security Vulnerabilities and Issues — Orangehrm@2.6.0.1 CVE List

Lucene search

OrangehrmOrangehrm2.6.0.1

5 matches found

CVE•added 2014/09/17 2:55 p.m.•40 views

CVE-2012-1507

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to inde...

4.3CVSS5.8AI score0.03374EPSS

Web

CVE•added 2013/02/12 8:55 p.m.•38 views

CVE-2011-5258

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the (1) uniqcode or (2) isAdmin parameter to index.php; or the (3) PATH_INFO to lib/controllers/centralcontroller.php.

4.3CVSS5.9AI score0.065EPSS

Web

CVE•added 2014/09/17 2:55 p.m.•37 views

CVE-2012-1506

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from th...

6.5CVSS8.1AI score0.0232EPSS

Web

CVE•added 2011/04/27 12:55 a.m.•34 views

CVE-2010-4798

Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the uri parameter.

6.8CVSS7.4AI score0.01197EPSS

CVE•added 2013/02/12 8:55 p.m.•31 views

CVE-2011-5259

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

6.8CVSS8.7AI score0.01845EPSS

Web