İçeriğe atla
Noroxi

orangehrm kayıtları

orangehrm üreticisine ait 31 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
0 · %0
Pre-auth RCE
2
Düzeltme kaydı olan
%32,3
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 19
  2. 20
  3. 21
  4. 22
  5. 24
  6. 25
  7. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

31 kayıt
  • CVE-2007-1193
    37İzleyin

    Multiple unspecified vulnerabilities in the Login page in OrangeHRM before 20070212 have unknown impact and attack vectors.

    KritikCVSS 9,3İstismar yokEPSS %1

    orangehrm · orangehrm2 Mar 2007

  • CVE-2019-12839
    36İzleyin

    In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows

    YüksekCVSS 8,8İstismar yokEPSS %4

    orangehrm · orangehrm15 Haz 2019

  • CVE-2025-66224
    36İzleyin

    OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection

    KritikCVSS 9,0Kavram kanıtıEPSS %1

    orangehrm · orangehrm29 Kas 2025

  • CVE-2025-66289
    34İzleyin

    OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change

    YüksekCVSS 8,7İstismar yokEPSS %0

    orangehrm · orangehrm29 Kas 2025

  • CVE-2025-66225
    34İzleyin

    OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow

    YüksekCVSS 8,7İstismar yokEPSS %0

    orangehrm · orangehrm29 Kas 2025

  • CVE-2020-29437
    33İzleyin

    SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the or

    YüksekCVSS 8,1İstismar yokEPSS %3

    orangehrm · orangehrm5 Oca 2021

  • CVE-2024-36428
    33İzleyin

    OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.

    YüksekCVSS 8,1İstismar yokEPSS %2

    orangehrm · orangehrm27 May 2024

  • CVE-2010-4798
    28İzleyin

    Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote attackers to include and execute arbitrary local files via

    OrtaCVSS 6,8Kavram kanıtıEPSS %2

    orangehrm · orangehrm26 Nis 2011

  • CVE-2025-44040
    28İzleyin

    An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function.

    YüksekCVSS 7,2İstismar yokEPSS %0

    orangehrm · orangehrm21 May 2025

  • CVE-2011-5259
    27İzleyin

    SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitra

    OrtaCVSS 6,8Kavram kanıtıEPSS %1

    orangehrm · orangehrm12 Şub 2013

  • CVE-2012-1506
    26İzleyin

    SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    orangehrm · orangehrm17 Eyl 2014

  • CVE-2012-5367
    24İzleyin

    Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands v

    OrtaCVSS 6,0Kavram kanıtıEPSS %1

    orangehrm · orangehrm3 Ara 2012

  • CVE-2021-28399
    21İzleyin

    OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function.

    OrtaCVSS 5,3İstismar yokEPSS %1

    orangehrm · orangehrm26 Nis 2021

  • CVE-2013-1353
    21İzleyin

    Orange HRM 2.7.1 allows XSS via the vacancy name.

    OrtaCVSS 5,4İstismar yokEPSS %1

    orangehrm · orangehrm10 Şub 2020

  • CVE-2022-28985
    21İzleyin

    A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web

    OrtaCVSS 5,4İstismar yokEPSS %1

    orangehrm · orangehrm19 May 2022

  • CVE-2022-27107
    21İzleyin

    OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" param

    OrtaCVSS 5,4İstismar yokEPSS %0

    orangehrm · orangehrm6 Nis 2022

  • CVE-2022-27109
    21İzleyin

    OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.

    OrtaCVSS 5,4İstismar yokEPSS %0

    orangehrm · orangehrm6 Nis 2022

  • CVE-2022-27110
    21İzleyin

    OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.

    OrtaCVSS 5,4İstismar yokEPSS %0

    orangehrm · orangehrm6 Nis 2022

  • CVE-2026-39348
    21İzleyin

    OrangeHRM is Missing Authorization Checks in AbstractFileController Subclasses Expose Job Specification and Vacancy Attachments

    OrtaCVSS 5,3İstismar yokEPSS %0

    orangehrm · orangehrm7 Nis 2026

  • CVE-2026-39346
    21İzleyin

    OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding

    OrtaCVSS 5,3İstismar yokEPSS %0

    orangehrm · orangehrm7 Nis 2026

  • CVE-2025-66291
    21İzleyin

    OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments

    OrtaCVSS 5,3İstismar yokEPSS %0

    orangehrm · orangehrm29 Kas 2025

  • CVE-2025-66290
    21İzleyin

    OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachments

    OrtaCVSS 5,3İstismar yokEPSS %0

    orangehrm · orangehrm29 Kas 2025

  • CVE-2007-5931
    20İzleyin

    The reDirect function in lib/controllers/RepViewController.php in OrangeHRM before 2.2.2 does not verify the privileges of a user, which all

    OrtaCVSS 5,0İstismar yokEPSS %1

    orangehrm · orangehrm10 Kas 2007

  • CVE-2011-3766
    20İzleyin

    OrangeHRM 2.6.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installatio

    OrtaCVSS 5,0İstismar yokEPSS %1

    orangehrm · orangehrm23 Eyl 2011

  • CVE-2026-39347
    20İzleyin

    OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion

    OrtaCVSS 5,1İstismar yokEPSS %0

    orangehrm · orangehrm7 Nis 2026