CVE-2026-39349 | Low | 2.7 | 2026-04-07 | OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB m… |
CVE-2026-39348 | Medium | 4.3 | 2026-04-07 | OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source omits authorization on job specification and vacanc… |
CVE-2026-39347 | Low | 2.7 | 2026-04-07 | OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for a… |
CVE-2026-39346 | Medium | 5.4 | 2026-04-07 | OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source allowed authenticated users to bypass disabled-modu… |
CVE-2026-39345 | Medium | 4.9 | 2026-04-07 | OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source fails to restrict email template file resolution to… |
CVE-2025-66291 | Medium | 4.3 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in the Recruitment mo… |
CVE-2025-66290 | Medium | 4.3 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s recruitment attachment retrieval endpoint does… |
CVE-2025-66289 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user… |
CVE-2025-66225 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username su… |
CVE-2025-66224 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail… |
CVE-2025-44040 | High | 7.2 | 2025-05-21 | An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be mad… |
CVE-2024-36428 | High | 8.1 | 2024-05-27 | OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection. |
CVE-2022-28985 | Medium | 6.3 | 2022-05-20 | A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2022-27110 | Medium | 5.4 | 2022-04-06 | OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint. |
CVE-2022-27109 | Medium | 5.4 | 2022-04-06 | OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability. |
CVE-2022-27108 | Medium | 4.3 | 2022-04-06 | OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`. Any user can create a ti… |
CVE-2022-27107 | Medium | 5.4 | 2022-04-06 | OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" parameter |
CVE-2021-28399 | Medium | 5.3 | 2021-04-26 | OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function. |
CVE-2020-29437 | High | 8.1 | 2021-01-05 | SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/l… |
CVE-2013-1353 | Medium | 5.4 | 2020-02-10 | Orange HRM 2.7.1 allows XSS via the vacancy name. |
CVE-2019-12839 | High | 8.8 | 2019-06-15 | In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated atta… |
CVE-2014-100021 | | | 2015-01-13 | Cross-site scripting (XSS) vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote attackers to inject arbitrary we… |
CVE-2012-1507 | | | 2014-09-17 | Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspSta… |
CVE-2012-1506 | | | 2014-09-17 | SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute ar… |
CVE-2011-5259 | | | 2013-02-12 | SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via… |
CVE-2011-5258 | | | 2013-02-12 | Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the (1) uniq… |
CVE-2012-5367 | | | 2012-12-03 | Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField pa… |
CVE-2011-3766 | | | 2011-09-24 | OrangeHRM 2.6.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error… |
CVE-2010-4798 | | | 2011-04-27 | Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote attackers to include and execute arbitrary local files via directory traversa… |
CVE-2007-5931 | | | 2007-11-10 | The reDirect function in lib/controllers/RepViewController.php in OrangeHRM before 2.2.2 does not verify the privileges of a user, which allows remote attacker… |
CVE-2007-1193 | | | 2007-03-02 | Multiple unspecified vulnerabilities in the Login page in OrangeHRM before 20070212 have unknown impact and attack vectors. |