CVE-2011-5259

no score yetEPSS 1.2%

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2013-02-12
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

orangehrm:orangehrm

References

http://blog.orangehrm.com/2011/12/09/security-vulnerabilities-fixed-with-orangehrm-26112/
http://osvdb.org/show/osvdb/77418
http://secunia.com/advisories/47014
http://www.securityfocus.com/archive/1/520684/100/0/threaded
http://www.securityfocus.com/bid/50857

Check your stack JSON