VULNERABILITY INTELLIGENCE

CVE-2020-29437

CVSS score8.1 HIGH

EPSS probability2.85%

CISA KEVNot currently listed

Published2021-01-05

Last modified2026-06-17

Description

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint.