CVE-2025-40682
SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - cve-coordination@incibe.es
- Published
- 2025-07-29
- Last modified
- 2025-07-29
- Weaknesses
- CWE-89
Affected products
- Human Resource Management System (Human Resource Management System)
- Human Resource Management System (Oretnom23)
References
- https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system
