Hrm Os
Monthly
Missing authentication in the Role Permission API of Omega Solution HRM OS (versions up to 20260717) lets remote, unauthenticated attackers read role-permission data without a session or credential. Manipulating the roleId argument on the /role-permission/permission endpoint bypasses the intended access check entirely (CWE-306), and publicly available exploit code exists for this path. The exposure is limited to low-confidentiality disclosure - no integrity or availability impact was assessed - so the practical risk depends on whether the HRM OS instance and this API endpoint are reachable from attacker-controlled networks.
Cross-site scripting in Omega HRM OS up to 20260717 allows an authenticated attacker with high privileges and file-upload permissions to inject malicious SVG files through the /media/view/ endpoint. Publicly available exploit code exists, enabling attacks that execute arbitrary JavaScript in a victim's browser when they view the crafted SVG. This is a low-severity issue due to the high privilege requirement and mandatory user interaction, and no vendor patch is available.
Improper control of resource identifiers in Omega Solution HRM OS (versions up to 20260717) allows an authenticated low-privilege user to enumerate the permission mappings of arbitrary roles by manipulating the roleId parameter of the /role-permission/permission endpoint. The outcome is confidentiality-only: role and permission metadata can be read, but no data can be modified and no code can be executed, and the CVSS v4.0 base is only 2.1 (assessed CVSS v3.1 4.3, AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N). Publicly available exploit code exists (PoC referenced via VulDB and the linked GitHub issue), but there is no confirmed active exploitation (not in CISA KEV); the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.
Missing authentication in the Role Permission API of Omega Solution HRM OS (versions up to 20260717) lets remote, unauthenticated attackers read role-permission data without a session or credential. Manipulating the roleId argument on the /role-permission/permission endpoint bypasses the intended access check entirely (CWE-306), and publicly available exploit code exists for this path. The exposure is limited to low-confidentiality disclosure - no integrity or availability impact was assessed - so the practical risk depends on whether the HRM OS instance and this API endpoint are reachable from attacker-controlled networks.
Cross-site scripting in Omega HRM OS up to 20260717 allows an authenticated attacker with high privileges and file-upload permissions to inject malicious SVG files through the /media/view/ endpoint. Publicly available exploit code exists, enabling attacks that execute arbitrary JavaScript in a victim's browser when they view the crafted SVG. This is a low-severity issue due to the high privilege requirement and mandatory user interaction, and no vendor patch is available.
Improper control of resource identifiers in Omega Solution HRM OS (versions up to 20260717) allows an authenticated low-privilege user to enumerate the permission mappings of arbitrary roles by manipulating the roleId parameter of the /role-permission/permission endpoint. The outcome is confidentiality-only: role and permission metadata can be read, but no data can be modified and no code can be executed, and the CVSS v4.0 base is only 2.1 (assessed CVSS v3.1 4.3, AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N). Publicly available exploit code exists (PoC referenced via VulDB and the linked GitHub issue), but there is no confirmed active exploitation (not in CISA KEV); the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.