PT-2025-31191 · Unknown · Human Resource Management System

Rafael Pedrero · Published 2025-07-29 · Updated 2025-07-29 · CVE-2025-40682

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Human Resource Management System version 1.0

Description A SQL injection vulnerability exists in Human Resource Management System version 1.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases via the city and state parameters in the /controller/ccity.php endpoint.

Recommendations Human Resource Management System version 1.0: Sanitize or validate the city and state parameters within the /controller/ccity.php endpoint to prevent SQL injection attacks.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-40682

Affected Products

Human Resource Management System

References · 8

• https://osv.dev/vulnerability/CVE-2025-40682 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40682 · Security Note
• https://twitter.com/CveFindCom/status/1950174481646764467 · Twitter Post
• https://t.me/CVEtracker/28655 · Telegram Post
• https://twitter.com/CVEnew/status/1950186967536119901 · Twitter Post
• https://t.me/cveNotify/130113 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system · Note
• https://twitter.com/VulmonFeeds/status/1950208097500152309 · Twitter Post