ByteOS Network

NVD Vulnerability Details :

CVE-2012-1507

Modified

Source-cve@mitre.org

Published At-17 Sep, 2014 | 14:55

Updated At-06 May, 2026 | 22:30

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index.php.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

orangehrm>>orangehrm>>Versions up to 2.6.12.1(inclusive)

cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6

cpe:2.3:a:orangehrm:orangehrm:2.6:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.0

cpe:2.3:a:orangehrm:orangehrm:2.6.0:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.0.1

cpe:2.3:a:orangehrm:orangehrm:2.6.0.1:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.1

cpe:2.3:a:orangehrm:orangehrm:2.6.1:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.2

cpe:2.3:a:orangehrm:orangehrm:2.6.2:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.3

cpe:2.3:a:orangehrm:orangehrm:2.6.3:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.4

cpe:2.3:a:orangehrm:orangehrm:2.6.4:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.5

cpe:2.3:a:orangehrm:orangehrm:2.6.5:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.6

cpe:2.3:a:orangehrm:orangehrm:2.6.6:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.7

cpe:2.3:a:orangehrm:orangehrm:2.6.7:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.8

cpe:2.3:a:orangehrm:orangehrm:2.6.8:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.8.1

cpe:2.3:a:orangehrm:orangehrm:2.6.8.1:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.9

cpe:2.3:a:orangehrm:orangehrm:2.6.9:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.10

cpe:2.3:a:orangehrm:orangehrm:2.6.10:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.11

cpe:2.3:a:orangehrm:orangehrm:2.6.11:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.11.2

cpe:2.3:a:orangehrm:orangehrm:2.6.11.2:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.11.3

cpe:2.3:a:orangehrm:orangehrm:2.6.11.3:*:*:*:*:*:*:*

orangehrm>>orangehrm>>2.6.12

cpe:2.3:a:orangehrm:orangehrm:2.6.12:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://blog.orangehrm.com/2012/04/24/orangehrm-27-stable-release-with-complete-localization/	cve@mitre.org	Patch
http://osvdb.org/81744	cve@mitre.org	N/A
http://osvdb.org/81745	cve@mitre.org	N/A
http://osvdb.org/81746	cve@mitre.org	N/A
http://secunia.com/advisories/49072	cve@mitre.org	N/A
http://www.securityfocus.com/bid/53433	cve@mitre.org	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/75473	cve@mitre.org	N/A
https://www.htbridge.com/advisory/HTB23080	cve@mitre.org	Exploit
http://blog.orangehrm.com/2012/04/24/orangehrm-27-stable-release-with-complete-localization/	af854a3a-2127-422b-91ae-364da2661108	Patch
http://osvdb.org/81744	af854a3a-2127-422b-91ae-364da2661108	N/A
http://osvdb.org/81745	af854a3a-2127-422b-91ae-364da2661108	N/A
http://osvdb.org/81746	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/49072	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/53433	af854a3a-2127-422b-91ae-364da2661108	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/75473	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.htbridge.com/advisory/HTB23080	af854a3a-2127-422b-91ae-364da2661108	Exploit