CVE-2023-54399: Hongjing E-Hr

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payload to read arbitrary database content, including credential tables such as operuser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

Affected products

• Hongjing E-Hr: before 8.2 (fixed in 8.2)

Published 2026-09-18. Last modified 2026-09-22.