CVE Feed

    Dashboard / CVE / CVE-2023-54399

    CVE-2023-54399

    Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payload to read arbitrary database content, including credential tables such as operuser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

    Published:Sep 18, 2026
    Last Modified:Sep 21, 2026
    EPS:Sep 18, 2026
    EPSS Score:0.00416
    CVSS Score:9.8

    Affected Products

    Vendor
    Hongjing
    Product
    E-hr

    Exploits

    No exploit reference

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High