CVE-2025-40682: SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state”…

Critical severity · published Jul 29, 2025

CVE-2025-40682

SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state”…

9.8

CVSS

0.3%

EPSS

On KEV

Description

SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 25% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Human Resource Management System · Oretnom23

1.0 · source: NVD

Affected product

Human Resource Management System

Oretnom23

All Human Resource Management System CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-40682

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-40682

Third Party Advisory

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system

More from Human Resource Management System

9.8

CVE-2024-35469

A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQL commands via the password parameter

9.8

CVE-2023-3391

A vulnerability was found in SourceCodester Human Resource Management System 1.0

9.8

CVE-2022-4273

A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0

9.8

CVE-2022-43262

Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /hrm/controller/login.php

9.8

CVE-2022-3458

SourceCodester Human Resource Management System Image File employeeview.php unrestricted upload