CVE-2024-10440

Affected product: Sunnet eHDR CTMS. Vulnerability: SQL Injection allowing unauthenticated remote attackers to inject arbitrary SQL to read, modify, and delete database contents. Impact: High on confidentiality, integrity, and availability (CVSS v3.1 base score 9.8). References: TWCERT entries. Ex...

CVE-2024-10438

Sunnet eHRD CTMS is affected by CVE-2024-10438, an authentication bypass vulnerability that enables unauthenticated remote access to certain functionalities. Public records (NVD/NVD mirrors) describe this as an authentication bypass with CVSSv3.1 metrics indicating Network attack vector, low comp...

CVE-2024-10439

The CVE-2024-10439 entry concerns the Sunnet eHRD CTMS system, where an Insecure Direct Object Reference (IDOR) vulnerability exists in a parameter that allows unauthenticated remote attackers to access arbitrary files uploaded by any user. Affected software: eHRD CTMS from Sunnet (no other produ...

CVE-2025-3707

The CVE-2025-3707 entry concerns Sunnet’s eHDR CTMS which is affected by a SQL Injection vulnerability in the CTMS component. The issue allows remote attackers with regular privileges to inject arbitrary SQL commands and read database contents, with the confidentiality impact rated High (CVSS 3.1...

CVE-2023-24836

CVE-2023-24836 affects SUNNET CTMS. The vulnerability is a path traversal flaw in the file-uploading function that an authenticated remote attacker with general user privileges can exploit to upload and execute scripts in arbitrary directories, enabling arbitrary system operations or service disr...

CVE-2026-7490

Sunnet CTMS and CPAS are affected by an Arbitrary File Upload vulnerability that can allow privileged remote attackers to upload and execute web shell backdoors, enabling arbitrary code execution on the server. The CVSS vectors indicate high severity (7.2/8.6) with network access, low attack comp...

CVE-2026-7489

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2025-54942

CVE-2025-54942 describes a missing authentication for a critical function in the SUNNET Corporate Training Management System prior to version 10.11, allowing remote attackers to access deployment functionality without credentials. The vulnerability is corroborated by multiple connected records (N...

CVE-2025-54945

CVE-2025-54945 affects SUNNET Corporate Training Management System prior to 10.11. The vulnerability is an external control of file name or path that enables remote attackers to execute arbitrary system commands by steering the destination file path. No explicit exploitation details are provided ...

CVE-2025-9567

CVE-2025-9567 affects Sunnet’s eHRD CTMS (the eHRD platform) and is described as a Reflected Cross-site Scripting vulnerability. The vulnerability allows unauthenticated remote attackers to cause arbitrary JavaScript execution in a user’s browser via phishing-type vectors. Technical details acros...

CVE-2025-9568

CVE-2025-9568 concerns Sunnet’s eHRD CTMS, reported as a Reflected Cross‑Site Scripting vulnerability. The issue enables unauthenticated remote attackers to run arbitrary JavaScript in a user’s browser via phishing, via a reflected XSS vector. The connected documents consistently describe the vul...

CVE-2025-54946

CVE-2025-54946 affects SUNNET Corporate Training Management System prior to 10.11. Multiple sources confirm a SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands, with high impact on confidentiality, integrity, and availability. Root cause: unsafeguarded con...

CVE-2025-9570

Summary of findings for CVE-2025-9570 (Sunnet eHRD CTMS) : The eHRD CTMS product from Sunnet is affected by an Arbitrary File Reading vulnerability caused by a Relative Path Traversal flaw in the file handling logic. This could allow remote attackers with administrator privileges to download arbi...

CVE-2025-9569

Sunnet eHRD CTMS (Sunnet) has a Reflected Cross-site Scripting vulnerability (CVE-2025-9569). The issue is exploitable via phishing, where unauthenticated remote attackers can cause a user’s browser to execute arbitrary JavaScript. Affected component is the web interface; root cause is reflected ...

CVE-2025-54943

SUNNET Corporate Training Management System before 10.11 has a missing authorization flaw due to inadequate access control checks, enabling remote deployment of applications. The PT-2025-35337 advisory lists versions prior to 10.11 as affected and recommends upgrading to a version newer than 10.1...

CVE-2025-54944

CVE-2025-54944 affects SUNNET Corporate Training Management System prior to version 10.11. An unrestricted upload of files with dangerous types allows remote attackers to write malicious code to a specific file, potentially leading to arbitrary code execution. Root cause: insufficient validation ...