CVE-2025-51682
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The vulnerability in mJobtime 15.7.2 handles authorization on the client side, allowing an attacker to modify client-side code and gain access to administrative features. Additionally, they can craft requests based on the client-side code to call these administrative functions directly.
Risk Assessment
The risk for the organization includes unauthorized access to the administrative panel, which can lead to privilege escalation, data theft, or full compromise of the mJobtime system.
Recommendation
Immediately update mJobtime to a version where authorization is handled server-side, and implement server-side request validation mechanisms.
Other vulnerabilities in mJobtime
See all- CVE-2026-9209Critical
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.
- CVE-2025-51683Critical
A blind SQL injection vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the /Default.aspx/update_profile_Server endpoint.
Original NVD description (English source)
mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features. Additionally, they can craft requests based on the client-side code to call these administrative functions directly.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS