CVE-2025-10197

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in HJSoft HCM Human Resources Management System up to 20250822. Affected by this vulnerability is an unknown functionality of the file /templates/attestation/../../selfservice/lawresource/downlawbase. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Sep 10, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-101987.8Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a maliciouCVE-2025-101997.8A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unqCVE-2025-10209.8Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that wCVE-2025-102008.8Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap coCVE-2025-102018.8Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypasCVE-2025-102037.8Relative path traversal vulnerability due to improper input validation in Digilent WaveForms that may result in arbitrary code execution. SCVE-2025-102047.1A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form foCVE-2025-102058.8Use of a One-Way Hash with a Predictable Salt vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. and newer versionsCVE-2025-102077.2Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5.CVE-2025-102095.4A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component AuthorizationCVE-2025-10217.5Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 CVE-2025-102108.8A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.