Orangehrm vulnerabilities
We track 4 vulnerabilities in Orangehrm products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 29, 2025.
Latest Orangehrm vulnerabilities
- 8.8 High severity
OrangeHRM is a comprehensive human resource management (HRM) system.
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid indefi
- 8.8 High severity
orangehrm: Weak Password Recovery Mechanism for Forgotten Password
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username submitted in the final reset request matches the account for which the reset process was originally ini
- 8.8 High severity
orangehrm: Improper Control of Generation of Code
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail configuration and delivery workflow that allows user-controlled values to flow directly into the sys
- 7.2 High severity
Orangehrm: Improper Privilege Management
An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be made via PHP loose-equality comparisons if a specific MD5 value is present in the credential store. NOTE