Non évaluée
SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuz...
CVE-2020-29437
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint.
Références
- advisory github.com
- advisory github.com
- patch github.com
- report horizon3.ai