CVE-2020-37145: Hrsale

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

HRSALE 1.1.8 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized administrative users through the employee registration form. Attackers can craft a malicious HTML page with hidden form fields to trick authenticated administrators into creating new user accounts with elevated privileges.

Affected products

• Hrsale Hrsale: version 1.1.8 only

Published 2026-02-05. Last modified 2026-06-17.