CVE-2025-51506

MEDIO 6.5CVE-2025-51506 · Published 19/08/2025 · updated 17/06/2026

In breve

CVE-2025-51506 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda hrforecast suite (talentneuron).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.32%, superiore al 25.6% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
hrforecast suite talentneuron	`= 0.4.3`	No fix yet

Description

In the smartLibrary component of the HRForecast Suite 0.4.3, a SQL injection vulnerability was discovered in the valueKey parameter. This flaw enables any authenticated user to execute arbitrary SQL queries, via crafted payloads to valueKey to the api/smartlibrary/v2/en/dictionaries/options/lookup endpoint.

References

MVRC-ITSEC/CVEs · Third Party Advisory
hrforecast.com · Product
hrforecast.com/smartlibrary-job-architecture · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free