Threats tagged 'ghsa-p5g3-q37q-686c'

weDevs ERP (WP ERP) versions through 1.17.11 have an incorrect authorization vulnerability that allows authenticated employees to modify their own HR records. This occurs because HRM AJAX handlers check the erp_edit_employee capability instead of the intended erp_manage_jobinfo capability. Exploiting this flaw, attackers can change sensitive job-related information such as designation, reporting manager, pay rate, employment type, or delete job history.