e-HR vulnerabilities

2 known vulnerabilities in e-HR from Hongjing. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  e-HR: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-54399Sep 18, 2026Hongjing

  Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can

• 9.8 Critical severity

  e-HR: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-6655Dec 10, 2023HongjingEPSS 3.74%

  A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /w_selfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interfa