CVE-2026-15478

MediumCVSS 6.3

Published: 12/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

A SQL injection vulnerability has been found in IceHRM up to version 35.0.1 in the EmployeeAttendanceReport.php file. An attacker can remotely manipulate the employeeList argument, leading to unauthorized database access. The exploit has been published and may be used.

Risk Assessment

The organization is at risk of data leakage or modification, compromising confidentiality and integrity. Remote unauthenticated attack increases the likelihood of rapid exploitation.

Recommendation

Immediately update IceHRM to the latest version or apply temporary mitigations such as input validation and parameterized SQL queries. Monitor the system for exploitation attempts.

Other vulnerabilities in IceHRM

CVE-2026-91770Medium
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.

Original NVD description (English source)

A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employeeList can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS