Critical severity · published Jul 29, 2025
CVE-2025-40682
SQL injection vulnerability in Human Resource Management System
9.8
CVSS
0.3%
EPSS
No
On KEV
Description
SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HR
Human Resource Management System · Human Resource Management System
1.0 · source: vendor, NVD
Affected product
HR
Human Resource Management System
Human Resource Management System
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40682
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40682
Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system
More from Human Resource Management System
6.1
CVE-2025-40686
Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management System
6.1
CVE-2025-40685
Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management System
6.1
CVE-2025-40684
Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management System
6.1
CVE-2025-40683
Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management System