CVE-2011-5259: Orangehrm

Medium severity, CVSS 6.8. EPSS: 1.2% chance of exploitation in the next 30 days.

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Affected products

• Orangehrm Orangehrm: up to and including 2.6.11; version 2.6.0 only; version 2.6.0.1 only; version 2.6.1 only; version 2.6.2 only; version 2.6.3 only; …

Published 2013-02-12. Last modified 2026-06-16.