Security Advisory

CVE-2020-29437

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2021-01-05 20:30:55

Last updated 2024-08-04 16:55:09

Assigner mitre

State PUBLISHED

Description

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint.

← Browse all CVEs View on cve.org ↗