Which versions of InHire are affected by CVE-2025-6142?

Organizations using Intera InHire should be aware of moderate risk from CVE-2025-6142, a server-side request forgery vulnerability rated CVSS 6.3.

How to fix or mitigate CVE-2025-6142?

Within 30 days: Identify affected systems running Intera InHire and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

InHire CVE-2025-6142

Q: What is the CVSS score of CVE-2025-6142?

CVE-2025-6142 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18432 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2025-06-16 cna@vuldb.com

SSRF

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

PR:L due to authentication required; C:L and I:L from SSRF; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18432

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

CVE Published

Jun 16, 2025 - 22:16 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was found in Intera InHire up to 20250530. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument 29chcotoo9 leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery (SSRF) in Intera InHire up to 20250530 allows remote authenticated attackers to make internal network requests. A public exploit exists, but no active exploitation has been confirmed. EPSS score is low (0.06%), indicating limited exploitation likelihood.

Technical ContextAI

The vulnerability is a server-side request forgery (CWE-918) in Intera InHire, a recruitment management system. The affected parameter '29chcotoo9' is manipulated to trigger SSRF, enabling the application to make requests to internal or external resources. The CVSS vector indicates low privileges required (PR:L) and low impact to confidentiality, integrity, and availability.

RemediationAI

No vendor patch is available as the vendor did not respond. Compensating controls include restricting outbound network access from the application server via firewall rules, validating and sanitizing user-supplied URLs, and implementing allowlists for permitted destinations. Disable the vulnerable functionality if possible. Monitor for unusual outbound requests.