CVE-2026-7490 | High | 7.2 | 2026-05-02 | CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, t… |
CVE-2026-7489 | High | 8.8 | 2026-05-02 | CTMS developed by Sunnet has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delet… |
CVE-2025-15226 | Critical | 9.8 | 2025-12-29 | WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, there… |
CVE-2025-15225 | High | 7.5 | 2025-12-29 | WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitr… |
CVE-2025-9570 | Medium | 4.9 | 2025-09-01 | The eHRD CTMS developed by Sunnet has an Arbitrary File Reading vulnerability, allowing remote attackers with administrator privileges to exploit Relative Path… |
CVE-2025-9569 | Medium | 6.1 | 2025-09-01 | The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code… |
CVE-2025-9568 | Medium | 6.1 | 2025-09-01 | The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code… |
CVE-2025-9567 | Medium | 6.1 | 2025-09-01 | The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code… |
CVE-2025-3707 | Medium | 6.5 | 2025-05-02 | The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL command to read database… |
CVE-2024-10440 | Critical | 9.8 | 2024-10-28 | The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL command to read, modify, and del… |
CVE-2024-10439 | Medium | 5.3 | 2024-10-28 | The eHRD CTMS from Sunnet has an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated remote attackers to modify a specific paramete… |
CVE-2024-10438 | High | 7.5 | 2024-10-28 | The eHRD CTMS from Sunnet has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to bypass authentication by satisfying specific… |
CVE-2023-35851 | High | 7.5 | 2023-09-18 |
SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain… |
CVE-2023-35850 | High | 7.2 | 2023-09-18 |
SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or… |
CVE-2023-24836 | High | 8.8 | 2023-04-27 | SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privilege can exploit th… |
CVE-2021-43360 | High | 8.8 | 2021-12-01 | Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated re… |
CVE-2021-43359 | High | 8.8 | 2021-12-01 | Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general us… |
CVE-2021-43358 | High | 7.5 | 2021-12-01 | Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, a… |
CVE-2020-10510 | High | 8.1 | 2020-03-27 | Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. After login, attackers can use a specific U… |
CVE-2020-10509 | Medium | 6.1 | 2020-03-27 | Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting (XSS), attackers can inject arbitrary command i… |
CVE-2020-10508 | High | 7.5 | 2020-03-27 | Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential info… |
CVE-2019-11062 | Critical | 9.8 | 2019-07-11 | The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited witho… |