Advisories · Technology
orangehrm.
Every CVE that names orangehrm among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.1 Low
OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure
- orangehrm
- Weak cryptography or TLS
- CVSS 5.3 Medium
OrangeHRM is Missing Authorization Checks in AbstractFileController Subclasses Expose Job Specification and Vacancy Attachments
- orangehrm
- Broken access control
- CVSS 5.1 Medium
OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion
- orangehrm
- Broken access control
- CVSS 5.3 Medium
OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding
- orangehrm
- Broken access control
- CVSS 4.6 Medium
OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader
- orangehrm
- Path traversal
- CVSS 5.3 Medium
OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments
- orangehrm
- Information disclosure
- Broken access control
- CVSS 5.3 Medium
OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachments
- orangehrm
- Information disclosure
- Broken access control
- CVSS 8.7 High
OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change
- orangehrm
- Authentication bypass
- CVSS 8.7 High
OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow
- orangehrm
- CWE-20
- CWE-345
- CVSS 9.0 CriticalCritical · CVSS 9+
OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection
- orangehrm
- Code injection