orangehrm vulnerabilities
10 published CVEs name orangehrm among the affected products.
- 10Published CVEs10 of them scored
- 10Last 12 monthspublished in the last year
- 1Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-39349
OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure
orangehrm · orangehrm
Low2.1 - CVE-2026-39348
OrangeHRM is Missing Authorization Checks in AbstractFileController Subclasses Expose Job Specification and Vacancy Attachments
orangehrm · orangehrm
Medium5.3 - CVE-2026-39347
OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion
orangehrm · orangehrm
Medium5.1 - CVE-2026-39346
OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding
orangehrm · orangehrm
Medium5.3 - CVE-2026-39345
OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader
orangehrm · orangehrm
Medium4.6 - CVE-2025-66291
OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments
orangehrm · orangehrm
Medium5.3 - CVE-2025-66290
OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachments
orangehrm · orangehrm
Medium5.3 - CVE-2025-66289
OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change
orangehrm · orangehrm
High8.7 - CVE-2025-66225
OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow
orangehrm · orangehrm
High8.7 - CVE-2025-66224
OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection
orangehrm · orangehrm
Critical9.0