GCVE - cpe:2.3:a:mamurjor:mamurjor_employee

Approved changes feed: RSS · Atom

cpe:2.3:a:mamurjor:mamurjor_employee_info:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Mamurjor (`97e6a5f2-bf64-5d6d-bd6a-7ef1c8950b2f`)
Product	Mamurjor Employee Info (`a8e10c19-03e3-50bb-96a9-0a5784ccdbea`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-13990`	vulnerable	2026-06-08 07:06:33.340867	Mamurjor Employee Info <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Employee and Related Data Manipulation MEDIUM (4.3) The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to create, update, or delete employee records, departments, designations, salary grades, education records, and salary payments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Published: 2026-01-07T09:21:00.842Z Updated: 2026-04-08T17:06:17.678Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/8e323b87-7b2e-4e5c-94a4-a4a0712f50ba?source=cve https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L10 https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L30 https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L47 https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L10	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.