CVE-2021-28399: Orangehrm

Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days.

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password function.

Affected products

• Orangehrm Orangehrm: version 4.7 only

Published 2021-04-26. Last modified 2026-06-17.