agentprime: orangehrmEvery new CVE for orangehrm.https://agentprime.io/CVE-2026-39349: OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosurehttps://agentprime.io/advisories/CVE-2026-39349/https://agentprime.io/advisories/CVE-2026-39349/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 18:22:38 GMTCVECVE-2026-39348: OrangeHRM is Missing Authorization Checks in AbstractFileController Subclasses Expose Job Specification and Vacancy Attachmentshttps://agentprime.io/advisories/CVE-2026-39348/https://agentprime.io/advisories/CVE-2026-39348/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 18:21:29 GMTCVECVE-2026-39347: OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completionhttps://agentprime.io/advisories/CVE-2026-39347/https://agentprime.io/advisories/CVE-2026-39347/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 18:20:35 GMTCVECVE-2026-39346: OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encodinghttps://agentprime.io/advisories/CVE-2026-39346/https://agentprime.io/advisories/CVE-2026-39346/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 18:19:24 GMTCVECVE-2026-39345: OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loaderhttps://agentprime.io/advisories/CVE-2026-39345/https://agentprime.io/advisories/CVE-2026-39345/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 18:17:35 GMTCVECVE-2025-66291: OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachmentshttps://agentprime.io/advisories/CVE-2025-66291/https://agentprime.io/advisories/CVE-2025-66291/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 29 Nov 2025 03:08:00 GMTCVECVE-2025-66290: OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachmentshttps://agentprime.io/advisories/CVE-2025-66290/https://agentprime.io/advisories/CVE-2025-66290/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 29 Nov 2025 03:06:56 GMTCVECVE-2025-66289: OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Changehttps://agentprime.io/advisories/CVE-2025-66289/https://agentprime.io/advisories/CVE-2025-66289/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 29 Nov 2025 03:06:25 GMTCVECVE-2025-66225: OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflowhttps://agentprime.io/advisories/CVE-2025-66225/https://agentprime.io/advisories/CVE-2025-66225/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 29 Nov 2025 03:05:46 GMTCVECVE-2025-66224: OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injectionhttps://agentprime.io/advisories/CVE-2025-66224/https://agentprime.io/advisories/CVE-2025-66224/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 29 Nov 2025 03:04:42 GMTCVEcritical