← Database

CVE-2025-40682

CRITICAL CVSS: 9.8 Published: 2025-07-29 Modified: 2026-06-17

Description

SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint.

Affected Platforms

Oretnom23 Human Resource Management System

Weakness Type

CWE-89

References