Threats tagged 'ghsa-8w9v-279h-hchp'

Wukong_HRM version 0 contains an authentication bypass vulnerability in the ParamAspect component. This flaw allows unauthenticated attackers to access all HRM API endpoints by omitting the AUTH-TOKEN header. Exploitation grants attackers HR administrator privileges, enabling them to read sensitive employee data such as payslips and salary history, download attachments, and modify or delete company-wide HR records. The vulnerability has a critical CVSS 4.0 score of 9.3.