Skip to content
Noroxi

orangehrm records

31 published records for vendor orangehrm.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
32.3%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

31 records
  • CVE-2007-1193
    37Monitor

    Multiple unspecified vulnerabilities in the Login page in OrangeHRM before 20070212 have unknown impact and attack vectors.

    CriticalCVSS 9.3No exploitEPSS 1%

    orangehrm · orangehrmMar 2, 2007

  • CVE-2019-12839
    36Monitor

    In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows

    HighCVSS 8.8No exploitEPSS 4%

    orangehrm · orangehrmJun 15, 2019

  • CVE-2025-66224
    36Monitor

    OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection

    CriticalCVSS 9.0Proof of conceptEPSS 0%

    orangehrm · orangehrmNov 29, 2025

  • CVE-2025-66289
    34Monitor

    OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change

    HighCVSS 8.7No exploitEPSS 0%

    orangehrm · orangehrmNov 29, 2025

  • CVE-2025-66225
    34Monitor

    OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow

    HighCVSS 8.7No exploitEPSS 0%

    orangehrm · orangehrmNov 29, 2025

  • CVE-2020-29437
    33Monitor

    SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the or

    HighCVSS 8.1No exploitEPSS 2%

    orangehrm · orangehrmJan 5, 2021

  • CVE-2024-36428
    33Monitor

    OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.

    HighCVSS 8.1No exploitEPSS 1%

    orangehrm · orangehrmMay 27, 2024

  • CVE-2010-4798
    28Monitor

    Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote attackers to include and execute arbitrary local files via

    MediumCVSS 6.8Proof of conceptEPSS 2%

    orangehrm · orangehrmApr 26, 2011

  • CVE-2025-44040
    28Monitor

    An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function.

    HighCVSS 7.2No exploitEPSS 0%

    orangehrm · orangehrmMay 21, 2025

  • CVE-2011-5259
    27Monitor

    SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitra

    MediumCVSS 6.8Proof of conceptEPSS 1%

    orangehrm · orangehrmFeb 12, 2013

  • CVE-2012-1506
    26Monitor

    SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated

    MediumCVSS 6.5Proof of conceptEPSS 1%

    orangehrm · orangehrmSep 17, 2014

  • CVE-2012-5367
    24Monitor

    Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands v

    MediumCVSS 6.0Proof of conceptEPSS 1%

    orangehrm · orangehrmDec 3, 2012

  • CVE-2021-28399
    21Monitor

    OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function.

    MediumCVSS 5.3No exploitEPSS 0%

    orangehrm · orangehrmApr 26, 2021

  • CVE-2013-1353
    21Monitor

    Orange HRM 2.7.1 allows XSS via the vacancy name.

    MediumCVSS 5.4No exploitEPSS 0%

    orangehrm · orangehrmFeb 10, 2020

  • CVE-2022-28985
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web

    MediumCVSS 5.4No exploitEPSS 0%

    orangehrm · orangehrmMay 19, 2022

  • CVE-2022-27107
    21Monitor

    OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" param

    MediumCVSS 5.4No exploitEPSS 0%

    orangehrm · orangehrmApr 6, 2022

  • CVE-2022-27109
    21Monitor

    OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.

    MediumCVSS 5.4No exploitEPSS 0%

    orangehrm · orangehrmApr 6, 2022

  • CVE-2022-27110
    21Monitor

    OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.

    MediumCVSS 5.4No exploitEPSS 0%

    orangehrm · orangehrmApr 6, 2022

  • CVE-2025-66291
    21Monitor

    OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments

    MediumCVSS 5.3No exploitEPSS 0%

    orangehrm · orangehrmNov 29, 2025

  • CVE-2025-66290
    21Monitor

    OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachments

    MediumCVSS 5.3No exploitEPSS 0%

    orangehrm · orangehrmNov 29, 2025

  • CVE-2026-39348
    21Monitor

    OrangeHRM is Missing Authorization Checks in AbstractFileController Subclasses Expose Job Specification and Vacancy Attachments

    MediumCVSS 5.3No exploitEPSS 0%

    orangehrm · orangehrmApr 7, 2026

  • CVE-2026-39346
    21Monitor

    OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding

    MediumCVSS 5.3No exploitEPSS 0%

    orangehrm · orangehrmApr 7, 2026

  • CVE-2007-5931
    20Monitor

    The reDirect function in lib/controllers/RepViewController.php in OrangeHRM before 2.2.2 does not verify the privileges of a user, which all

    MediumCVSS 5.0No exploitEPSS 1%

    orangehrm · orangehrmNov 10, 2007

  • CVE-2011-3766
    20Monitor

    OrangeHRM 2.6.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installatio

    MediumCVSS 5.0No exploitEPSS 1%

    orangehrm · orangehrmSep 23, 2011

  • CVE-2026-39347
    20Monitor

    OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion

    MediumCVSS 5.1No exploitEPSS 0%

    orangehrm · orangehrmApr 7, 2026