CVE-2026-39349

>= 5.0 and < 5.8.1

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensi

2.7LOW

CVE-2026-39348

>= 5.0 and < 5.8.1

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source omits authorization on

4.3MEDIUM

CVE-2026-39347

>= 5.0 and < 5.8.1

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to sel

2.7LOW

CVE-2026-39346

>= 5.0 and < 5.8.1

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source allowed authenticated

5.4MEDIUM

CVE-2026-39345

>= 5.0 and < 5.8.1

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source fails to restrict emai

4.9MEDIUM

CVE-2025-66291

>= 5.0 and < 5.8

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval e

4.3MEDIUM

CVE-2025-66290

>= 5.0 and < 5.8

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s recruitment atta

4.3MEDIUM

CVE-2025-66289

>= 5.0 and < 5.8

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate

8.8HIGH

CVE-2025-66225

>= 5.0 and < 5.8

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not

8.8HIGH

CVE-2025-66224

>= 5.0 and < 5.8

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-ne

8.8HIGH

CVE-2025-44040

all versions

An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authen

7.2HIGH

CVE-2024-36428

all versions

OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.

8.1HIGH

CVE-2022-28985

all versions

A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arb

6.3MEDIUM

CVE-2022-27110

all versions

OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.

5.4MEDIUM

CVE-2022-27109

all versions

OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.

5.4MEDIUM

CVE-2022-27108

all versions

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimeshe

4.3MEDIUM

CVE-2022-27107

all versions

OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddre

5.4MEDIUM

CVE-2021-28399

all versions

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function.

5.3MEDIUM

CVE-2020-29437

< 4.6.0.1

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands

8.1HIGH

CVE-2013-1353

all versions

Orange HRM 2.7.1 allows XSS via the vacancy name.

5.4MEDIUM

CVE-2019-12839

<= 4.3.1

In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) t

8.8HIGH

CVE-2014-100021

<= 3.1.1

Cross-site scripting (XSS) vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote att

CVE-2012-1507

<= 2.6.12.1

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script

CVE-2012-1506

<= 2.6.12.1

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote auth

CVE-2011-5259

<= 2.6.11

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execu

CVE-2011-5258

<= 2.6.11

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web sc

CVE-2012-5367

all versions

Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL

CVE-2011-3766

all versions

OrangeHRM 2.6.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the i

CVE-2010-4798

all versions

Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote attackers to include and execute arbitrary local

CVE-2007-5931

<= 2.2.1

The reDirect function in lib/controllers/RepViewController.php in OrangeHRM before 2.2.2 does not verify the privileges of a user,

CVE-2007-1193

all versions

Multiple unspecified vulnerabilities in the Login page in OrangeHRM before 20070212 have unknown impact and attack vectors.