PT-2025-20074 · Lemesconsultoria · Lemesconsultoria Hcm Galera.App

Wellington Almeida · Published 2025-05-07 · Updated 2025-05-08 · CVE-2025-29154

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions lemesconsultoria HCM galera.app version 4.58.0

Description The issue allows an attacker to execute arbitrary code via multiple API endpoints, including "/ted/solicitacao treinamento/", "/rh/metas/perspectiva estrategica/edicao/", "/rh/cadastros/perspectivas/listagem/adc/", "/escolaridade/listagem/", "/estados civis/cadastro/", "/nivel hierarquico/listagem/", "/nivel decisorio/cadastro/", "/escolaridade/cadastro/", "/nivel decisorio/listagem/", "/rh/cadastros/perspectivas/listagem/", "/empresas grupo/cadastro/", "/empresas/edicao/", "/liais/listagem/", "/noticias/listagem/", "/gerenciamento-de-ciclo/abertura/cadastrar", "/colaborador/cadastro/cursos/adc/edicao/", "/colaborador/cadastro/adc/", "/cads aux/escalact/", "/ncf/tec/cadastro/ct/", "/rh/metas/painel/", "/rh/metas/equipe/edicao/", "/rh/pdi/tipo recursos/edicao/", "/rh/pdi/familia recursos/cadastro/", "/rh/pdi/fornecedores/edicao/", and "/rh/pdi/recursos/cadastro/".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-29154

Affected Products

Lemesconsultoria Hcm Galera.App

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-29154 · Security Note
• https://t.me/cvenotify/121351 · Telegram Post
• https://wellington-almeida.medium.com/poc-html-injection-0f27e657c962 · Note
• https://t.me/cvedetector/24711 · Telegram Post
• https://worzyus.medium.com/0f27e657c962 · Note
• https://t.me/cvetracker/23264 · Telegram Post