VYPR
← All advisories
Low severity2.7NVD Advisory· Published Apr 7, 2026· Updated Apr 10, 2026

CVE-2026-39349

CVE-2026-39349

Description

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability is fixed in 5.8.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Orangehrm/Orangehrm2 versions
    cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*range: >=5.0,<5.8.1
    • (no CPE)range: >=5.0, <=5.8

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.