What is the CVSS score of CVE-2025-67102?

CVE-2025-67102 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Jorani are affected by CVE-2025-67102?

Jorani users running version 1.0.4 or earlier face a critical SQL injection risk in the leave management system that could allow authenticated users to extract or manipulate sensitive employee and…

How to fix or mitigate CVE-2025-67102?

Within 24 hours: Identify all Jorani instances running v1.0.4 or earlier and restrict access to the alldayoffs feature to essential HR personnel only. Within 7 days: Implement WAF rules to block SQL injection patterns in the entity parameter, or disable the alldayoffs feature entirely if operationally feasible. Within 30 days: Coordinate with Jorani vendor for patch availability; consider migrating to alternative leave management solutions if patch timeline is unclear, and conduct database access audit for unauthorized activity.

Jorani CVE-2025-67102

HIGH

SQL Injection (CWE-89)

2026-02-17 cve@mitre.org

SQLi Jorani

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 17, 2026 - 20:22 nvd

HIGH 7.6

DescriptionCVE.org

A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the entity parameter.

AnalysisAI

A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the entity parameter. [CVSS 7.6 HIGH]

Technical ContextAI

Classified as CWE-89 (SQL Injection). A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the entity parameter.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.