PT-2025-34291 · Unknown · Hrmaster Module

Apor · Published 2025-08-21 · Updated 2025-08-21 · CVE-2025-51989

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions: HRmaster module version 235

Description: An HTML injection flaw exists in the registration interface of the HRmaster module. An attacker can inject HTML tags into the keresztnév (firstname) field. This injected HTML is included in emails, potentially enabling phishing attacks against previously unregistered email addresses.

Recommendations: Sanitize user input in the keresztnév (firstname) field during the registration process to prevent HTML injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-51989

Affected Products

Hrmaster Module

References · 7

• 🔥 https://github.com/Apor/Vulnerabilities/tree/main/CVE-2025-51989 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-51989 · Security Note
• https://evolution-consulting.hu · Note
• https://hrmaster.hu/modulok/toborzas-es-kivalasztas · Note
• http://evolution.com · Note
• http://hrmaster.com · Note
• https://twitter.com/CVEnew/status/1958659358566621204 · Twitter Post