CVE-2025-40682: ORETNOM23 Human Resource Management System

Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days.

SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint.

Affected products

• ORETNOM23 Human Resource Management System: version 1.0 only

Published 2025-07-29. Last modified 2026-06-17.