CVE-2011-5258

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the (1) uniqcode or (2) isAdmin parameter to index.php; or the (3) PATH_INFO to lib/controllers/centralcontroller.php.

• CWE-79

• http://blog.orangehrm.com/2011/12/09/security-vulnerabilities-fixed-with-orangehrm-26112/Vendor Advisory
• http://osvdb.org/show/osvdb/77416Exploit
• http://osvdb.org/show/osvdb/77417Exploit
• http://secunia.com/advisories/47014Vendor Advisory
• http://www.securityfocus.com/archive/1/520684/100/0/threaded
• http://www.securityfocus.com/bid/50857Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71568
• https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_orangehrm.htmlExploit
• http://blog.orangehrm.com/2011/12/09/security-vulnerabilities-fixed-with-orangehrm-26112/Vendor Advisory
• http://osvdb.org/show/osvdb/77416Exploit
• http://osvdb.org/show/osvdb/77417Exploit
• http://secunia.com/advisories/47014Vendor Advisory
• http://www.securityfocus.com/archive/1/520684/100/0/threaded
• http://www.securityfocus.com/bid/50857Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71568
• https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_orangehrm.htmlExploit

Published

Feb 12, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-5252Open redirect vulnerability in Users/Account/LogOff in Orcha…
• CVE-2011-5253Dl Download Ticket Service 0.3 through 0.9 allows remote att…
• CVE-2011-5254Unspecified vulnerability in the Connections plugin before 0…
• CVE-2011-5255Multiple cross-site scripting (XSS) vulnerabilities in admin…
• CVE-2011-5256Cross-site scripting (XSS) vulnerability in the tooltips in …
• CVE-2011-5257Multiple cross-site scripting (XSS) vulnerabilities in the C…
• CVE-2011-5259SQL injection vulnerability in lib/controllers/CentralContro…
• CVE-2011-5260Cross-site scripting (XSS) vulnerability in SAP/BW/DOC/METAD…
• CVE-2011-5261Cross-site scripting (XSS) vulnerability in serverreport.cgi…
• CVE-2011-5262SQL injection vulnerability in prodpage.cfm in SonicWALL Ave…
• CVE-2011-5263Cross-site scripting (XSS) vulnerability in RetrieveMailExam…
• CVE-2011-5264Cross-site scripting (XSS) vulnerability in lazyest-backup.p…