Skip to content
OpenAdvisories

Vendor

orangehrm

10 known vulnerabilities.

Products

orangehrm 10
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2025-66289

    OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change

    OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid indef…

    orangehrm orangehrm
  • High 8.7
    CVE-2025-66225

    OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow

    OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username submitted in the final reset request matches the account for which the reset process was originally in…

    orangehrm orangehrm