CVE-2020-9270: Icehrm

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php.

Affected products

• Icehrm Icehrm: version 26.2.0.os only

Published 2020-02-18. Last modified 2026-06-17.