CVE-2020-9271: Icehrm

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php.

Affected products

• Icehrm Icehrm: version 26.2.0.os only

Published 2020-02-18. Last modified 2026-06-17.