Log in Start free

orangehrm

Products

ProductCVEsExploitedLatest
orangehrm10–Apr 7, 2026

Exploited and recent CVEs

  • CVE-2026-39349 Low 2.1 OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure 0.1%
  • CVE-2026-39348 Medium 5.3 OrangeHRM is Missing Authorization Checks in AbstractFileController Subclasses Expose Job Specification and Vacancy Attachments 0.2%
  • CVE-2026-39347 Medium 5.1 OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion 0.2%
  • CVE-2026-39346 Medium 6.5 OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding 0.2%
  • CVE-2026-39345 Medium 4.6 OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader 0.3%
  • CVE-2025-66291 Medium 5.3 OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments 0.2%
  • CVE-2025-66290 Medium 5.3 OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachments 0.2%
  • CVE-2025-66289 High 8.7 OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change 0.3%
  • CVE-2025-66225 High 8.7 OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow 0.2%
  • CVE-2025-66224 Critical 9.0 OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection 0.6%