CVE-2025-44040
Last modified
CVE-2025-44040 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be made via PHP loose-equality comparisons if a specific MD5 value is present in the credential store. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be made via PHP loose-equality comparisons if a specific MD5 value is present in the credential store. NOTE: this is disputed by the Supplier because an adversary has no way to place the specific MD5 value into the credential store (unless they already have full privileges) and because the specific MD5 value would not realistically be present otherwise.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Orangehrm | Orangehrm | 5.7 |
References
- https://github.com/hexomedin3/advisories/tree/main/CVE-2025-44040Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-44040?
How severe is CVE-2025-44040?
How do I fix CVE-2025-44040?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-44024Cross-Site Scripting (XSS) vulnerability was discovered in t…6.1
- CVE-2025-4403The Drag and Drop Multiple File Upload for WooCommerce plugi…9.8
- CVE-2025-44033SQL injection vulnerability in oa_system oasys v.1.1 allows …9.8
- CVE-2025-44034SQL injection vulnerability in oa_system oasys v.1.1 allows …8
- CVE-2025-44039CP-XR-DE21-S -4G Router Firmware version 1.031.022 was disco…5.1
- CVE-2025-4404A privilege escalation from host to domain vulnerability was…9.1
- CVE-2025-44043Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Si…5.4
- CVE-2025-44044Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML Exter…7.5
- CVE-2025-4405The Hot Random Image plugin for WordPress is vulnerable to S…5.4
- CVE-2025-4406The wpForo Forum plugin for WordPress is vulnerable to Store…5.4
- CVE-2025-4407Insufficient Session Expiration vulnerability in ABB Lite Pa…6.8
- CVE-2025-44071SeaCMS v13.3 was discovered to contain a remote code executi…9.8
Are you affected by CVE-2025-44040?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST