CVE-2020-26805: Sapplica Sentrifugo

High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days.

In Sentrifugo 3.2, admin can edit employee's informations via this endpoint --> /sentrifugo/index.php/empadditionaldetails/edit/userid/2. In this POST request, "employeeNumId" parameter is affected by SQLi vulnerability. Attacker can inject SQL commands into query, read data from database or write data into the database.

Affected products

• Sapplica Sentrifugo: version 3.2 only

Published 2020-11-12. Last modified 2026-06-17.