Hongjing vulnerabilities
Published CVEs affecting Hongjing products: 1 record(s), with severity, exploitation and fixes.
CVE-2023-54399
Critical · 9.8
CWE-89 Sep 18, 2026
Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree
Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payload to read arbitrary database content, including credential tables such as operuser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.