CVE-2025-40682: SQL injection vulnerability in Human Resource Management System
SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40682?
CVE-2025-40682 has a high severity level due to its potential for exploitation through SQL injection.
How do I fix CVE-2025-40682?
To fix CVE-2025-40682, validate and sanitize input parameters, especially the 'city' and 'state' parameters in the /controller/ccity.php endpoint.
What can attackers do with CVE-2025-40682?
Attackers can retrieve, create, update, and delete databases via the vulnerable parameters in CVE-2025-40682.
Which software is affected by CVE-2025-40682?
CVE-2025-40682 affects version 1.0 of the Human Resource Management System.
How can I identify exploitation of CVE-2025-40682 in my system?
You can identify exploitation of CVE-2025-40682 by monitoring database activity for unauthorized queries or changes to records.