Vulnerability · Published Aug 31, 2025 · Assigned by VulDB

CVE-2025-9743code-projects Human Resource Integrated System login_attendance2.php sql injection

High 7.3

In plain English

A high-severity SQL injection in Human Resource Integrated System from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in code-projects Human Resource Integrated System 1.0. Impacted is an unknown function of the file login_attendance2.php. Performing manipulation of the argument employee_id/date results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.

Affected products (as reported)

Vendor	Product	Versions
code-projects	Human Resource Integrated System	1.0

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-322042 | code-projects Human Resource Integrated System login_attendance2.php sql injection vdb-entry, technical-description
VDB-322042 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #640113 | code-projects Human Resource Integrated System 1.0 SQL Injection third-party-advisory
https://github.com/cooorgi/cve/blob/main/hris_sql_login_attendance2.md exploit
https://code-projects.org/ product