Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Sep 14, 2026IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR recoCVE-2026-91770 · Other software · gamonoid · reported by VulnCheckHigh 7.1
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.
- Product
- icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2026A flaw has been found in IceHRM up to 35.0.1.CVE-2026-15478 · Other software · reported by VulDBLow 2.1
A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employeeList can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS.CVE-2024-46073 · Other software · reported by MITREMedium 6.1
A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. The vulnerability is due to improper sanitization of the "next" parameter, which is included in the application's response without adequate escaping. An attacker can exploit this flaw by tricking a user into visiting a specially crafted URL, causing the execution of arbitrary JavaScript code in the context of the victim's browser. The issue occurs even though the application has sanitization mechanisms in place.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting (XSS) vulnerability via /icehrm/app/fileupload_page.phCVE-2023-6282 · Other software · IceHrm · reported by cve-coordination@incibe.esMedium 5.4
IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting (XSS) vulnerability via /icehrm/app/fileupload_page.php, in multiple parameters. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload and partially hijacking the victim's browser.
- Product
- IceHrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2022A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/service.php URI.CVE-2022-26588 · Other software · Icehrm · reported by MITREMedium 6.5
A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/service.php URI.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.commedium.com
Feb 28, 2022A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into the First Name fielCVE-2022-25015 · Other software · Icehrm · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into the First Name field.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user.CVE-2022-25014 · Other software · Icehrm · reported by MITREMedium 6.1
Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user. This vulnerability allows attackers to compromise session credentials via user interaction with a crafted link.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters in the component logCVE-2022-25013 · Other software · Icehrm · reported by MITREMedium 6.1
Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters in the component login.php.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue.CVE-2021-38823 · Other software · Icehrm · reported by MITRECritical 9.8
The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue. A signout from an admin account does not invalidate an admin session that is opened in a different browser.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnavidkagalwalla.comnavidkagalwalla.com
Oct 4, 2021A Stored Cross Site Scripting vulnerability via Malicious File Upload exists in multiple pages of IceHrm 30.0.0.OS that allows for arbitrary execution of JavaScCVE-2021-38822 · Other software · Icehrm · reported by MITREMedium 5.4
A Stored Cross Site Scripting vulnerability via Malicious File Upload exists in multiple pages of IceHrm 30.0.0.OS that allows for arbitrary execution of JavaScript commands.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnavidkagalwalla.comnavidkagalwalla.com
Jun 22, 2021A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted session cookie.CVE-2021-35046 · Other software · Icehrm · reported by MITREMedium 6.1
A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted session cookie.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2021Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ endpoint.CVE-2021-35045 · Other software · Icehrm · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ endpoint.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2021A cross site request forgery (CSRF) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to create new admin accounts or change users' passwCVE-2021-34244 · Other software · Icehrm · reported by MITREHigh 8.8
A cross site request forgery (CSRF) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to create new admin accounts or change users' passwords.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2021A stored cross site scripting (XSS) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to execute arbitrary web scripts or HTML via a crafCVE-2021-34243 · Other software · Icehrm · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to execute arbitrary web scripts or HTML via a crafted file uploaded into the Document Management tab. The exploit is triggered when a user visits the upload location of the crafted file.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2020An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c51CVE-2020-6114 · Other software · Icehrm · reported by talos-cna@cisco.comHigh 7.2
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 18, 2020ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php.CVE-2020-9271 · Other software · Icehrm · reported by MITREMedium 6.5
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2020ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php.CVE-2020-9270 · Other software · Icehrm · reported by MITREHigh 8.8
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2018IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request.CVE-2018-12420 · Other software · Icehrm · reported by MITREHigh 7.5
IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request.
- Product
- Icehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.