CVE-2020-29437: Orangehrm

High severity, CVSS 8.1. EPSS: 2.8% chance of exploitation in the next 30 days.

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint.

Affected products

• Orangehrm Orangehrm: before 4.6.0.1 (fixed in 4.6.0.1)

Published 2021-01-05. Last modified 2026-06-17.