CVE-2025-40682 — SQL injection vulnerability in Human Resource Management System

CVE-2025-40682

SQL injection vulnerability in Human Resource Management System PUBLISHED

Description (CNA)

SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint.

Affected (CNA)

Vendor / product	Versions
Human Resource Management System / Human Resource Management System	affected 1.0

CWE

CWE-89

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.