Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-108707

Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect

Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wukongopensource
Products
Wukong Hrm
CVE-2026-108708

Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil

Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Wukongopensource
Products
Wukong Hrm