CVE-2012-1506: Orangehrm

Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days.

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from third party information.

Affected products

• Orangehrm Orangehrm: up to and including 2.6.12.1; version 2.6 only; version 2.6.0 only; version 2.6.0.1 only; version 2.6.1 only; version 2.6.2 only; …

Published 2014-09-17. Last modified 2026-06-16.