CVE-2026-39349lowCWE-326

CVE-2026-39349: falha de baixa gravidade em orangehrm

OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure

Publicada em

Seguir esta CVE+ Monitorar orangehrm

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.1epss 0.1%
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability is fixed in 5.8.1.
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
orangehrm · orangehrm
CVEs relacionadas — orangehrm

No mesmo produto, das mais perigosas para as menos.

CVE-2025-66224CRITICALOrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter InjectionEPSS 0.6%CVE-2026-39345MEDIUMOrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template LoaderEPSS 0.3%CVE-2025-66289HIGHOrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password ChangeEPSS 0.3%CVE-2025-66291MEDIUMOrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview AttachmentsEPSS 0.2%CVE-2025-66290MEDIUMOrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate AttachmentsEPSS 0.2%CVE-2025-66225HIGHOrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset WorkflowEPSS 0.2%