CVE-2026-39349
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
OrangeHRM Open Source from version 5.0 to 5.8 encrypts sensitive fields with AES in ECB mode, preserving plaintext patterns in ciphertext and enabling pattern disclosure against stored data. Fixed in version 5.8.1.
Risk Assessment
The organization is at risk of pattern disclosure of sensitive data stored in the HRM system, potentially leading to information leakage.
Recommendation
Upgrade OrangeHRM Open Source to version 5.8.1 or later.
Original NVD description (English source)
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability is fixed in 5.8.1.