CVE-2025-66225: orangehrm from 5.0 (inclusive), before 5.8 (exclusive), >= 5.0, < 5.8

Affected technology

orangehrm · from 5.0 (inclusive), before 5.8 (exclusive)
orangehrm

orangehrm · >= 5.0, < 5.8
orangehrm

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says after obtaining a valid reset link for any account they can receive email for, an attacker can alter the username parameter in the final reset request to target a different user. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.