CVE-2025-40682: high-severity vulnerability in Human Resource Management System
SQL injection vulnerability in Human Resource Management System
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Human Resource Management System · Human Resource Management SystemRelated CVEs — Human Resource Management System
In the same product, most dangerous first.
CVE-2025-40686MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management SystemEPSS 0.2%CVE-2025-40685MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management SystemEPSS 0.2%CVE-2025-40684MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management SystemEPSS 0.2%CVE-2025-40683MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management SystemEPSS 0.2%