SQL Injection Flaw in Human Resource Management System by INCo

CVE-2025-40682

What is CVE-2025-40682?

An SQL injection vulnerability exists in the Human Resource Management System version 1.0. This flaw allows attackers to manipulate database queries via the 'city' and 'state' parameters in the /controller/ccity.php endpoint. By exploiting this vulnerability, an attacker could potentially access sensitive information, create or modify records, and delete critical data, leading to significant disruptions and compromise of user data security.

References