CVE-2025-51989 describes an HTML injection vulnerability in the registration interface of Evolution Consulting Kft. HRmaster module version 235. Specifically, the 'keresztnév' (firstname) input field does not properly sanitize HTML content, allowing attackers to inject arbitrary HTML tags. These injected tags are then included in outgoing emails, which may be used to craft phishing messages targeting recipients who have not previously registered. The vulnerability is classified under CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). The CVSS v3.1 base score is 7.0, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation allows attackers to inject malicious HTML into emails sent by the HRmaster module, potentially facilitating phishing attacks against unregistered email recipients. This can lead to disclosure of sensitive information or tricking users into performing harmful actions. The confidentiality impact is high, while integrity and availability impacts are low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider implementing input validation or sanitization on the 'keresztnév' field to prevent HTML injection. Additionally, scrutinize outgoing emails for injected content and educate users to recognize phishing attempts.