CVE-2025-51989

Published: Aug 21, 2025Modified: Jul 5, 2026Deferred

7.0

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Exploitability: 2.2 / Impact: 4.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

HTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster module v235 allows an attacker to inject HTML tags into the "keresztnév" (firstname) field, which will be sent out in an email resulting in possible Phishing scenarios against any, previously not registered, email address.

Related CWEs

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

References (3)

https://github.com/Apor/Vulnerabilities/tree/main/CVE-2025-51989

Source: cve@mitre.org

https://hrmaster.hu/modulok/toborzas-es-kivalasztas

Source: cve@mitre.org

https://www.evolution-consulting.hu/

Source: cve@mitre.org

Timeline

No history available yet.