CVE-2013-2498: Simplehrm

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

SQL injection vulnerability in the login page in flexycms/modules/user/user_manager.php in SimpleHRM 2.3, 2.2, and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to index.php/user/setLogin.

Affected products

• Simplehrm Simplehrm: up to and including 2.2; version 2.3 only

Published 2014-03-01. Last modified 2026-06-16.