Sun.Net vulnerabilities
27 vulnerabilities
Known vulnerabilities in Sun.Net products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.
Products
6CVE-2021-43359sunehrd+1
EPSS score2.47%
Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general user, then perform privilege escalation to execute arbitrary code and control the system or interrupt services.CVE-2021-43358sunehrd+1EPSS score2.37%
Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, access restricted paths and download system files.CVE-2021-43360sunehrd+1EPSS score2.40%
Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated remote attacker with database access privilege, to execute arbitrary code and control the system or interrupt services.CVE-2025-54946sunnet technology co., ltd.corporate training management system+1EPSS score0.48%
A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands.CVE-2025-54945sunnet technology co., ltd.corporate training management system+1EPSS score0.54%
An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path.CVE-2025-54943sunnet technology co., ltd.corporate training management system+1EPSS score0.50%
A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deployment due to the absence of proper access control checks.CVE-2025-54942sunnet technology co., ltd.corporate training management system+1EPSS score0.47%
A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to access deployment functionality without prior authentication.CVE-2025-54944sunnet technology co., ltd.corporate training management system+1EPSS score0.69%
An unrestricted upload of file with dangerous type vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to write malicious code in a specific file, which may lead to arbitrary code execution.CVE-2025-9570sun.netehrd_ctmsEPSS score0.52%
The eHRD CTMS developed by Sunnet has an Arbitrary File Reading vulnerability, allowing remote attackers with administrator privileges to exploit Relative Path Traversal to download arbitrary system files.CVE-2025-9567sun.netehrd_ctmsEPSS score0.26%
The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.CVE-2025-9568sun.netehrd_ctmsEPSS score0.26%
The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.CVE-2025-9569sun.netehrd_ctmsEPSS score0.26%
The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.CVE-2025-15226sun.netwmproEPSS score0.59%
WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.CVE-2025-15225sun.netwmproEPSS score0.54%
WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files.CVE-2025-3707sun.netehrd_ctmsEPSS score0.43%
The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL command to read database contents.CVE-2020-10510sunehrd+1EPSS score1.06%
Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. After login, attackers can use a specific URL, access unauthorized functionality and data.CVE-2020-10509sunehrd+1EPSS score0.86%
Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting (XSS), attackers can inject arbitrary command into the system and launch XSS attack.CVE-2020-10508sunehrd+1EPSS score1.51%
Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information.CVE-2024-10439sun.netehrd_ctmsEPSS score0.40%
The eHRD CTMS from Sunnet has an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to access arbitrary files uploaded by any user.CVE-2024-10438sun.netehrd_ctmsEPSS score0.53%
The eHRD CTMS from Sunnet has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to bypass authentication by satisfying specific conditions in order to access certain functionalities.